CVE Tools
Track your stack

Grav

183 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Grav, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Grav CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Grav CVEs per month
MonthCVEs
2024-110
2024-120
2025-011
2025-020
2025-030
2025-040
2025-050
2025-060
2025-072
2025-081
2025-090
2025-100
2025-111
2025-1222
2026-011
2026-020
2026-031
2026-040
2026-0511
2026-063
2026-0740
2026-0854
2026-0913
2026-109

Severity

How the 183 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical159%
  • High8147%
  • Medium7543%
  • Low21%

Latest CVEs

The 15 most recently published vulnerabilities affecting Grav.

  1. CVE-2026-114660Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form Directives6.3
  2. CVE-2026-114657Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via Twig Uri5.7
  3. CVE-2026-112782Grav before 1.7.53.5 and 2.2.2 Image Pixel Limit Bypass Denial of Service7.5
  4. CVE-2026-112781Grav 2.0.0 before 2.2.2 Information Disclosure via Form config-*@ Directives6.5
  5. CVE-2026-112780Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@8.8
  6. CVE-2026-109326Grav before 2.1.7 Information Disclosure via Nested .git Directories7.5
  7. CVE-2026-109325Grav from 2.0.22 before 2.1.7 Clockwork Profiler Authentication Bypass via Proxy7.5
  8. CVE-2026-109324Grav before 2.1.7 Memory Exhaustion via Oversized Image Transforms6.5
  9. CVE-2026-109315Grav 2.0.22 before 2.1.7 Clockwork Debugger Token Disclosure via Twig Sandbox6.5
  10. CVE-2026-100671Grav before 2.0.25 Session Cookie Theft via Twig Sandbox8.0
  11. CVE-2026-100669Grav before 2.0.25 Sensitive File Disclosure via Case-Variation Bypass7.5
  12. CVE-2026-100670Grav CMS 2.0.14 through 2.0.24 Privilege Escalation via Blueprint Guard Bypass8.8
  13. CVE-2026-100668Grav before 2.0.25 Sandbox Escape via array Filter6.5
  14. CVE-2026-100667grav-plugin-login 3.8.7 through 3.9.6 Two-Factor Authentication Bypass5.3
  15. CVE-2026-92917Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_r7.5

Product grouping is registry-driven, with AI assist and human review. How it works