G
Vendor security profile
getgrav
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs110
Critical14
CISA KEV0
Public exploit75
Patch rate%23
Avg. CVSS7.6
12-month vulnerability rate
0
15
0
0
0
0
0
1
13
66
15
0
CVE KEV
CVE severity distribution
110toplam CVE
Critical14 (13%)
High63 (57%)
Medium32 (29%)
Low1 (1%)
Patch and exploitation view
%23
Verified patch
%0
CISA KEV
%68
Public exploit
25Patch available
0Partial
0Workaround
0Vendor: no patch
85Unknown
Latest vulnerabilities
8.4
CVE-2026-100673
Grav Data Manager before 1.4.5 Stored XSS via item-detail view
G
Patch status unknownEPSS %0
8.7
CVE-2026-100672
grav-plugin-comments before 1.2.11 Unauthenticated Information Disclosure
G
Patch status unknownEPSS %0
8.6
CVE-2026-100671
Grav before 2.0.25 Session Cookie Theft via Twig Sandbox
G
Patch status unknownEPSS %0
8.7
CVE-2026-100670
Grav CMS 2.0.14 through 2.0.24 Privilege Escalation via Blueprint Guard Bypass
G
Patch status unknownEPSS %0
8.7
CVE-2026-100669
Grav before 2.0.25 Sensitive File Disclosure via Case-Variation Bypass
G
Patch status unknownEPSS %0
7.1
CVE-2026-100668
Grav before 2.0.25 Sandbox Escape via array Filter
G
Patch status unknownEPSS %0
6.9
CVE-2026-100667
grav-plugin-login 3.8.7 through 3.9.6 Two-Factor Authentication Bypass
G
Patch status unknownEPSS %0
8.7
CVE-2026-92917
Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_r
G
Patch status unknownEPSS %0
8.7
CVE-2026-92916
Grav through 2.0.21 Unauthenticated Information Disclosure via Clockwork
G
Patch status unknownEPSS %0
1.8
CVE-2025-64059
Cross-site scripting in Getgrav
G
Patch status unknownEPSS %0