| CVE |
Severity |
CVSS |
Risk |
Published |
Description |
Impact |
| CVE-2026-42611 |
high |
8.9 |
8.9 |
22d ago |
Grav is Vulnerable to Stored XSS via Tag Injection |
|
| CVE-2026-42844 |
high |
8.8 |
8.8 |
21d ago |
Low-privileged Grav API users can create super-admin accounts via blueprint-upload |
|
| CVE-2026-42609 |
high |
8.1 |
8.1 |
22d ago |
Grav Vulnerable to Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic |
|
| CVE-2026-44738 |
high |
7.7 |
7.7 |
15d ago |
Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray() |
|