Medium
CVE-2026-61455
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 101
Reset filters
High
CVE-2026-64850
Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()
Medium
CVE-2026-62237
Grav: Authenticated ReDoS via regex_replace in Twig Sandbox
Medium
CVE-2026-86197
Grav: Page editors can inject arbitrary script into rendered pages via the Twig sandbox's assets.addJs/addCss allowlist, escalating to super-admin
High
CVE-2026-62230
Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems
High
CVE-2026-53653
Grav: Unauthenticated denial of service via unbounded image derivative dimensions
Medium
CVE-2026-55890
Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style() — incomplete patch of GHSA-r7fx-8g49-7hhr
Medium
CVE-2026-55885
Grav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets
High
CVE-2026-44738
Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray()
Medium
CVE-2026-44737
Grav: Stored XSS via page title (data[header][title]) in admin panel
High
CVE-2026-42845
Grav Form Plugin has an Anonymous Page Content Overwrite via Form File Upload filename Override
High
CVE-2026-42844
Low-privileged Grav API users can create super-admin accounts via blueprint-upload
High
CVE-2026-42611
Grav is Vulnerable to Stored XSS via Tag Injection
Medium
CVE-2026-56701
Grav is Vulnerable to XXE via SVG Upload
High
CVE-2026-42608
Grav has Unauthenticated Path Traversal & Arbitrary File Write in its FormFlash component
High
CVE-2026-42609
Grav Vulnerable to Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic
Low
CVE-2026-7317
Grav has Insecure Deserialization in File Cache
Critical
CVE-2026-56700
Grav has multiple RCE vectors: unsafe unserialize (x3), command injection in git clone, SSTI blocklist bypass
High
CVE-2026-42612
Grav Vulnerable to Publisher-Level Stored XSS via Unquoted Event Attributes
Medium
CVE-2026-42610
Grav Vulnerable to Sensitive Information Disclosure via Accounts Service Bypass
Critical
CVE-2026-42613
Grav Vulnerable to Privilege Escalation via Missing Server-Side Validation of groups/access
Medium
CVE-2026-42842
Grav Vulnerable to XSS via Taxonomy Field Values in Admin Panel
Medium
CVE-2026-42841
Grav CMS vulnerable to stored XSS via Markdown media attribute() action
Critical
CVE-2026-42607
Grav Vulnerable to Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.