CVE-2026-62673

Grav is a file-based Web platform. Prior to 2.0.4, the Grav .htaccess and webserver-configs/htaccess.txt security rules omit the Apache NC flag and therefore compare sensitive directory and file-extension patterns case-sensitively. On a case-insensitive filesystem, an unauthenticated requester ca...

CVE-2026-63408

In Grav API Plugin before 1.0.0-rc.16, JwtAuthenticator::extractBearerToken() accepts a JWT via the ?token= URL query parameter on all /api/v1 routes, exposing valid tokens in Apache/proxy/CDN logs, browser history, and Referer headers. An attacker with access to those records can reuse the token...

EUVD-2026-62547

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extractBearerToken accepts a JWT from the token URL query parameter on every /api/v1 route, including state-changing endpoints...

CVE-2026-62673

Grav is a file-based Web platform. Prior to 2.0.4, the Grav .htaccess and webserver-configs/htaccess.txt security rules omit the Apache NC flag and therefore compare sensitive directory and file-extension patterns case-sensitively. On a case-insensitive filesystem, an unauthenticated requester ca...

EUVD-2026-62543

Grav is a file-based Web platform. Prior to 2.0.4, the Grav .htaccess and webserver-configs/htaccess.txt security rules omit the Apache NC flag and therefore compare sensitive directory and file-extension patterns case-sensitively. On a case-insensitive filesystem, an unauthenticated requester ca...

ROOT-OS-UBUNTU-2404-CVE-2026-31663 CVE-2026-31663 in linux - Patched by Root

Root has patched CVE-2026-31663 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2404-CVE-2024-57979 CVE-2024-57979 in linux - Patched by Root

Root has patched CVE-2024-57979 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2404-CVE-2026-52917 CVE-2026-52917 in linux - Patched by Root

Root has patched CVE-2026-52917 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2404-CVE-2025-39876 CVE-2025-39876 in linux - Patched by Root

Root has patched CVE-2025-39876 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2404-CVE-2026-43084 CVE-2026-43084 in linux - Patched by Root

Root has patched CVE-2026-43084 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2404-CVE-2026-46061 CVE-2026-46061 in linux - Patched by Root

Root has patched CVE-2026-46061 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2404-CVE-2025-39881 CVE-2025-39881 in linux - Patched by Root

Root has patched CVE-2025-39881 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2404-CVE-2026-31674 CVE-2026-31674 in linux - Patched by Root

Root has patched CVE-2026-31674 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2404-CVE-2026-31657 CVE-2026-31657 in linux - Patched by Root

Root has patched CVE-2026-31657 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2404-CVE-2026-31577 CVE-2026-31577 in linux - Patched by Root

Root has patched CVE-2026-31577 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2404-CVE-2025-38211 CVE-2025-38211 in linux - Patched by Root

Root has patched CVE-2025-38211 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2404-CVE-2025-38138 CVE-2025-38138 in linux - Patched by Root

Root has patched CVE-2025-38138 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2404-CVE-2025-38159 CVE-2025-38159 in linux - Patched by Root

Root has patched CVE-2025-38159 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2404-CVE-2024-56702 CVE-2024-56702 in linux - Patched by Root

Root has patched CVE-2024-56702 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

CVE-2026-61842

Grav is a file-based Web platform. Prior to 2.0.2, the Grav Twig content sandbox permits grav.offsetGet'config' to return the raw configuration object and permits jsonencode, printr, yamlencode, and string filters to serialize that object without passing through...