Grav-plugin-api
This hub aggregates every CVE we track for Grav-plugin-api, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.
6
CVEs tracked
0
Critical
5
High
0
In CISA KEV
Severity distribution
HIGH5MEDIUM1
Monthly trend
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
5
0
2024-102026-09
Latest CVEs
The 6 most recently published vulnerabilities affecting Grav-plugin-api.
- CVE-2026-63408Grav API Plugin: JWT Access Token Accepted via `?token=` URL Query Parameter7.5
- CVE-2026-63407Grav API Plugin: CORS 'Access-Control-Allow-Origin: *' on Authenticated API Responses8.2
- CVE-2026-62667Grav API Plugin : API Key 'scopes' Never Enforced - Delegated Least-Privilege Keys Carry Full User ACL8.1
- CVE-2026-62666Grav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of super8.8
- CVE-2026-61607Grav API Plugin: Stored XSS via SVG Upload - API Media Pipeline Bypasses Sanitizer4.6
- CVE-2026-42843grav-plugin-api: Grav API Privilege Escalation to Super Admin8.8
Product normalization is registry-driven with AI assist and human review. How it works