CVE-2026-65008 Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData

Grav 2.0.4 fixed in 2.0.7 contains a remote code execution vulnerability in Blueprint::dynamicData system/src/Grav/Common/Data/Blueprint.php, which passes a Class::method callable string and its arguments directly to calluserfuncarray without any allowlist. Because the form plugin routes page...

CVE-2026-64628 Grav Stored Cross-Site Scripting via Shortcode Attribute Handlers

Grav contains a stored cross-site scripting vulnerability in shortcode-core attribute handlers where the XSS detection scan only matches payloads containing literal angle brackets, allowing shortcode parameters to bypass validation. Attackers with admin.pages permission can inject malicious...