Packagist getgrav/grav

Name: Packagist getgrav/grav
Brand: Packagist

productUS

pkg:composer/getgrav/grav

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

by severity

3critical23high29medium1low

updated 2026-10-28

vulnerabilities (105)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2021-29440US	high7.2	29.9% (98th)	Exploit	1.7.11	2021-04-13	< 1.7.11
CVE-2024-28116US	high8.8	5.81% (93rd)	Exploit	1.7.45	2024-03-21	< 1.7.45
CVE-2026-42607US	—	4.38% (91st)	Exploit	2.0.0-beta.2	2026-05-11	< 2.0.0-beta.2
CVE-2025-66294US	high8.8	2.82% (86th)	Exploit	1.8.0-beta.27	2025-12-01	< 1.8.0-beta.27
CVE-2026-65008US	—	2.49% (85th)	Exploit	2.0.7	2026-07-21	< 2.0.7
CVE-2025-66301US	critical9.6	1.34% (71st)	Exploit	1.8.0-beta.27	2025-12-01	< 1.8.0-beta.27
CVE-2026-42613US	—OT elevated	1.14% (66th)	Exploit	2.0.0-beta.2	2026-05-11	< 2.0.0-beta.2
CVE-2026-75827US	—	0.86% (58th)	Exploit	2.0.15	2026-08-18	< 2.0.15
CVE-2024-27921US	high8.8	60.6% (99th)	—	1.7.45	2024-03-21	< 1.7.45
CVE-2022-2073US	high7.2	10.9% (96th)	—	1.7.34	2022-06-29	< 1.7.34
CVE-2020-11529US	medium6.1	10.9% (96th)	—	1.6.23	2020-04-04	< 1.6.23
CVE-2026-61450US	—	5.42% (93rd)	—	2.0.2	2026-07-10	< 2.0.2
CVE-2023-34448US	high7.2	4.52% (91st)	—	1.7.42	2023-06-14	< 1.7.42
CVE-2021-3924US	high7.5	4.36% (91st)	—	no fix	2021-11-05	≤ 1.7.24
CVE-2018-5233US	medium6.1	3.65% (90th)	—	1.3.0	2018-03-19	< 1.3.0
CVE-2024-34082US	critical9.9	3.04% (87th)	—	1.7.46	2024-05-15	< 1.7.46
CVE-2020-29555US	high8.1	2.90% (87th)	—	1.6.30	2021-03-15	2 versions
CVE-2023-37897US	high8.8	2.81% (86th)	—	1.7.42.2	2023-07-18	< 1.7.42.2
CVE-2026-56700US	—	2.53% (85th)	—	2.0.0-beta.2	2026-06-30	< 2.0.0-beta.2
CVE-2021-3818US	medium5.3	2.45% (84th)	—	1.7.21	2021-09-27	< 1.7.21
CVE-2023-34251US	high7.2	2.34% (84th)	—	1.7.42	2023-06-14	< 1.7.42
CVE-2023-34253US	high7.2	2.07% (81st)	—	1.7.42	2023-06-14	< 1.7.42
CVE-2023-34252US	high7.2	2.07% (81st)	—	1.7.42	2023-06-14	< 1.7.42
CVE-2022-0970US	medium5.4	1.80% (78th)	—	1.7.31	2022-03-15	< 1.7.31
CVE-2024-28119US	high8.8	1.58% (75th)	—	1.7.45	2024-03-21	< 1.7.45
CVE-2022-1173US	medium5.4	1.54% (75th)	—	1.7.33	2022-04-26	< 1.7.33
CVE-2019-16126US	medium6.1	1.54% (75th)	—	1.7.0-beta.8	2019-09-09	< 1.7.0-beta.8
CVE-2022-0268US	medium5.4	1.42% (73rd)	—	1.7.28	2022-01-25	< 1.7.28
CVE-2024-28117US	high8.8	1.39% (72nd)	—	1.7.45	2024-03-21	< 1.7.45
CVE-2022-0743US	medium4.6	1.36% (72nd)	—	1.7.31	2022-02-28	< 1.7.31
CVE-2020-29553US	high8.8	1.36% (72nd)	—	1.6.30	2021-03-15	2 versions
CVE-2024-27923US	high8.8	1.36% (72nd)	—	1.7.43	2024-03-21	< 1.7.43
CVE-2024-28118US	high8.8	1.22% (69th)	—	1.7.45	2024-03-21	< 1.7.45
CVE-2026-65608US	—	1.12% (66th)	—	2.0.9	2026-07-23	1.7.0 → 2.0.9
CVE-2023-31506US	medium5.4	1.00% (63rd)	—	no fix	2024-02-09	—
CVE-2020-29556US	medium5.5	0.98% (62nd)	—	1.6.30	2021-03-15	2 versions
CVE-2026-72819US	—	0.90% (60th)	—	2.0.13	2026-08-14	< 2.0.13
CVE-2025-66297US	high8.8	0.78% (56th)	—	1.8.0-beta.27	2025-12-01	< 1.8.0-beta.27
CVE-2026-72695US	high8.1	0.63% (50th)	—	2.0.16	2026-08-25	< 2.0.16
CVE-2025-66299US	—	0.61% (49th)	—	1.8.0-beta.27	2025-12-01	< 1.8.0-beta.27
CVE-2026-42608US	critical9.1	0.60% (49th)	—	2.0.0-beta.2	2026-05-11	< 2.0.0-beta.2
CVE-2026-59193US	medium4.9	0.60% (49th)	—	2.0.0	2026-07-10	1.0.0 → 2.0.0
CVE-2021-3904US	medium5.4	0.59% (48th)	—	1.7.24	2021-10-27	< 1.7.24
CVE-2025-66295US	—	0.55% (46th)	—	1.8.0-beta.27	2025-12-01	< 1.8.0-beta.27
CVE-2026-62673US	—	0.54% (45th)	—	2.0.4	2026-08-19	< 2.0.4
CVE-2026-61690US	—	0.53% (45th)	—	2.0.1	2026-08-19	< 2.0.1
CVE-2026-53653US	—	0.52% (44th)	—	1.7.53	2026-07-10	2 versions
CVE-2026-55890US	—	0.50% (43rd)	—	2.0.0-rc.9	2026-07-10	< 2.0.0-rc.9
CVE-2026-62669US	—OT elevated	0.50% (43rd)	—	2.0.4	2026-08-19	< 2.0.4
CVE-2026-75837US	—OT elevated	0.49% (42nd)	—	2.0.14	2026-08-18	< 2.0.14

showing 50 of 105

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')30 CVEs
CWE-94Improper Control of Generation of Code ('Code Injection')20 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')13 CVEs
CWE-1336Improper Neutralization of Special Elements Used in a Template Engine9 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor6 CVEs
CWE-269Improper Privilege Management4 CVEs
CWE-409Improper Handling of Highly Compressed Data (Data Amplification)4 CVEs
CWE-862Missing Authorization4 CVEs

sources (1)

Which sources assert this record, and when.

USOSV.dev105 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan