G
Vendor security profile
getgrav
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs124
Critical15
CISA KEV0
Public exploit75
Patch rate%37
Avg. CVSS7.6
12-month vulnerability rate
0
15
0
0
0
0
0
1
13
66
15
14
CVE KEV
CVE severity distribution
124toplam CVE
Critical15 (12%)
High71 (57%)
Medium37 (30%)
Low1 (1%)
Patch and exploitation view
%37
Verified patch
%0
CISA KEV
%60
Public exploit
46Patch available
0Partial
0Workaround
0Vendor: no patch
78Unknown
Latest vulnerabilities
8.7
CVE-2026-109326
Grav before 2.1.7 Information Disclosure via Nested .git Directories
G
Patch status unknownEPSS %0
8.7
CVE-2026-109325
Grav from 2.0.22 before 2.1.7 Clockwork Profiler Authentication Bypass via Proxy
G
Patch status unknownEPSS %0
7.1
CVE-2026-109324
Grav before 2.1.7 Memory Exhaustion via Oversized Image Transforms
G
Patch status unknownEPSS %0
6.9
CVE-2026-109323
Grav Star Ratings 2.0.1 through 2.0.3 Missing Server-Side vote_access Authorization
G
Patch status unknownEPSS %0
5.3
CVE-2026-109322
Grav Guestbook before 0.5.2 Stored XSS via AJAX Pagination and Admin Views
G
Patch status unknownEPSS %0
9.3
CVE-2026-109321
Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypass
G
Patch status unknownEPSS %0
5.3
CVE-2026-109320
Grav API Plugin before 1.0.36 Disabled Account Session Access Bypass
G
Patch status unknownEPSS %0
5.3
CVE-2026-109319
Grav Guestbook Plugin 0.5.0 and 0.5.1 Missing Authorization and CSRF in Moderation
G
Patch status unknownEPSS %0
8.6
CVE-2026-109317
Grav API Plugin before 1.0.36 Privilege Escalation via Scalar Access Grants
G
Patch status unknownEPSS %0
6.9
CVE-2026-109316
Grav Data Manager 1.4.0 through 1.4.5 Unauthenticated File Deletion via Admin
G
Patch status unknownEPSS %0