Getgrav / Grav-Plugin-Api
12 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-86196 | Grav API Plugin before 1.0.20 Authentication Bypass via Host Header | HIGH | 8.7 | Sep 5, 2026 |
| CVE-2026-86195 | grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super Flag | HIGH | 8.7 | Sep 5, 2026 |
| CVE-2026-86193 | Grav API Plugin Authentication Bypass via Group-Inherited Super | HIGH | 8.7 | Sep 5, 2026 |
| CVE-2026-64852 | Grav API Plugin: Missing authorization on API-key generate/revoke lets any admin.login user forge keys for any account | HIGH | 8.7 | Aug 19, 2026 |
| CVE-2026-63408 | Grav API Plugin: JWT Access Token Accepted via `?token=` URL Query Parameter | HIGH | 7.5 | Aug 19, 2026 |
| CVE-2026-63407 | Grav API Plugin: CORS 'Access-Control-Allow-Origin: *' on Authenticated API Responses | HIGH | 8.2 | Aug 19, 2026 |
| CVE-2026-62667 | Grav API Plugin : API Key 'scopes' Never Enforced - Delegated Least-Privilege Keys Carry Full User ACL | HIGH | 8.1 | Aug 19, 2026 |
| CVE-2026-62666 | Grav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of super | HIGH | 8.8 | Aug 19, 2026 |
| CVE-2026-62668 | Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocols | CRITICAL | 9.4 | Aug 19, 2026 |
| CVE-2026-61607 | Grav API Plugin: Stored XSS via SVG Upload - API Media Pipeline Bypasses Sanitizer | MEDIUM | 4.6 | Aug 19, 2026 |
| CVE-2026-72833 | Grav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API Keys | HIGH | 8.7 | Aug 14, 2026 |
| CVE-2026-42843 | grav-plugin-api: Grav API Privilege Escalation to Super Admin | HIGH | 8.8 | May 11, 2026 |
Showing 1 to 12 of 12 CVEs