BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

Getgrav

Getgrav Security Releases - October 2026

getgrav-2026-10 Oct 1, 2026 Source: Vendor

Getgrav security advisories for October 2026, compiled from CVE.org records.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://www.cve.org/CVERecord?id=CVE-2026-109312
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

16 lines
All 16 CVEs 16 Additional recognition 0 Unclaimed only
Showing 1–16 of 16
CVE-2026-109312 BR2026-0000-027244 grav-plugin-login unclaimed
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not that a pending front-end 2FA session is fully autho...
Credited as redwolf1919
CVE-2026-109313 BR2026-0000-027245 grav-plugin-login unclaimed
Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication through remember-me cookie restora...
Credited as redwolf1919
CVE-2026-109314 BR2026-0000-027246 grav-plugin-login unclaimed
Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain password-reset tokens by authoring a page at the reset route. When a victim op...
Credited as redwolf1919
CVE-2026-109315 BR2026-0000-027382 grav unclaimed
Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because the sandbox redaction list omits system.debugger...
Credited as manus-pi
CVE-2026-109315 BR2026-0000-027383 grav unclaimed
Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because the sandbox redaction list omits system.debugger...
Credited as manus-use
CVE-2026-109316 BR2026-0000-027384 grav-plugin-data-manager unclaimed
Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated attackers to delete stored data files via the classic Admin integration. Atta...
Credited as AlpetGexha
CVE-2026-109317 BR2026-0000-027385 grav-plugin-api unclaimed
Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent gran...
Credited as redwolf1919
CVE-2026-109319 BR2026-0000-027387 grav-plugin-guestbook unclaimed
Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-site request forgery vulnerabilities in Admin moderation actions delete, approve, and approveAll. Authenticated Admin ...
Credited as AlpetGexha
CVE-2026-109320 BR2026-0000-027388 grav-plugin-api unclaimed
The Grav API plugin (grav-plugin-api) before 1.0.36 contains an improper session validation vulnerability that allows disabled accounts to keep API access, because SessionAuthenticator does not enf...
Credited as AlpetGexha
CVE-2026-109321 BR2026-0000-027389 grav-plugin-login-oauth unclaimed
Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic <provider>.<id> username and an unsalted MD5 hash of the provide...
Credited as AlpetGexha
CVE-2026-109322 BR2026-0000-027390 grav-plugin-guestbook unclaimed
Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM a...
Credited as AlpetGexha
CVE-2026-109323 BR2026-0000-027391 grav-plugin-star-ratings unclaimed
Grav Star Ratings 2.0.1 through 2.0.3 contains a missing authorization vulnerability that allows unauthenticated visitors to vote by bypassing client-only vote_access and readonly enforcement. Atta...
Credited as AlpetGexha
CVE-2026-109324 BR2026-0000-027392 grav unclaimed
Grav before 2.1.7 contains a denial of service vulnerability that allows authenticated media authors to exhaust memory by uploading compressed oversized raster images. Attackers can reference a Twi...
Credited as manus-pi
CVE-2026-109324 BR2026-0000-027393 grav unclaimed
Grav before 2.1.7 contains a denial of service vulnerability that allows authenticated media authors to exhaust memory by uploading compressed oversized raster images. Attackers can reference a Twi...
Credited as manus-use
CVE-2026-109325 BR2026-0000-027394 grav unclaimed
Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE_ADDR values. Unauthenticated attackers behind a same-host HTTP pr...
Credited as Zagn
CVE-2026-109326 BR2026-0000-027395 grav unclaimed
Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root. Unauthenticated attackers can r...
Credited as onetrev