Grav-plugin-api

This hub aggregates every CVE we track for Grav-plugin-api, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 12 most recently published vulnerabilities affecting Grav-plugin-api.

• CVE-2026-86196Grav API Plugin before 1.0.20 Authentication Bypass via Host HeaderSep 5, 2026
• CVE-2026-86195grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super FlagSep 5, 2026
• CVE-2026-86193Grav API Plugin Authentication Bypass via Group-Inherited SuperSep 5, 2026
• CVE-2026-64852Grav API Plugin: Missing authorization on API-key generate/revoke lets any admin.login user forge keys for any accountAug 19, 2026
• CVE-2026-63408Grav API Plugin: JWT Access Token Accepted via `?token=` URL Query Parameter7.5Aug 19, 2026
• CVE-2026-63407Grav API Plugin: CORS 'Access-Control-Allow-Origin: *' on Authenticated API Responses8.2Aug 19, 2026
• CVE-2026-62667Grav API Plugin : API Key 'scopes' Never Enforced - Delegated Least-Privilege Keys Carry Full User ACL8.1Aug 19, 2026
• CVE-2026-62666Grav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of super8.8Aug 19, 2026
• CVE-2026-62668Grav API Plugin: Webhook SSRF via Unrestricted cURL ProtocolsAug 19, 2026
• CVE-2026-61607Grav API Plugin: Stored XSS via SVG Upload - API Media Pipeline Bypasses Sanitizer4.6Aug 19, 2026
• CVE-2026-11982Stored XSS via missing XSS safety check in Admin2 Pages API partial validationJun 18, 2026
• CVE-2026-42843grav-plugin-api: Grav API Privilege Escalation to Super Admin8.8May 11, 2026