Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 2 total.
CVE-2026-65008
CRITICAL
CVSS 9.3
Verified Advisory
Jul 21, 2026
Remote code execution via unrestricted callable in Grav CMS (CVE-2026-65008)
Grav's Blueprint::dynamicData() passes a Class::method callable string and its arguments directly to call_user_func_array() without any allowlist. An authenticated account with the admin.pages or api.pages.write permi...
Fixed in 2.0.7
RCE
Code Injection
Getgrav
PHP
CVE-2026-62232
CRITICAL
CVSS 9.1
Verified Advisory
Jul 17, 2026
Two-factor authentication bypass in Grav CMS (CVE-2026-62232)
A two-factor authentication bypass vulnerability exists in Grav CMS where the `login.regenerate2FASecret` task checks only for user existence rather than authorization during the pending TOTP challenge window. An atta...
Fixed in 2.0.4
Authentication Bypass
CSRF
Getgrav
Grav