Security Intel Hub 98+

Curated security advisories, vulnerability analyses, and exploit write-ups — auto-cleaned and translated to English. Updated continuously.

Filter

KEV only

Verified PoC

Clear filters

Premium intel

Critical

Grav CMS SSTI Leading to Remote Code Execution in Email Plugin (PoC)

github.com · 2026-08-14

Grav CMS 2.0.11

Medium

Grav API Plugin Authorization Bypass Analysis

github.com · 2026-08-14

getgrav/grav-plugin-api <= 1.0.12

Premium intel

High

Grav CMS 2.x Insecure Direct Object Reference via Static Method Invocation Bypass

github.com · 2026-08-03

Grav CMS >= 2.0.7, <= 2.0.10

High

Grav CMS Path Traversal in ImageMedium::watermark() - Arbitrary File Disclosure

github.com · 2026-08-03

Grav CMS 2.0.10

Low

Grav Form Plugin Dynamic Open Redirect via Twig Evaluation

github.com · 2026-08-03

getgrav/grav-plugin-form 9.1.12

Medium

Grav Plugin Login Session Expiration Bypass Allowing Credential Replay

github.com · 2026-07-29

getgrav/grav-plugin-login <= 3.8.12

Premium intel

Unknown

Grav CMS Pre-Auth Path Parsing Error Fix in Markdown Parser

github.com · 2026-07-23

Grav CMS < 2.0.13

Premium intel

Medium

Grav CMS Flex Framework RCE via Unvalidated dynamicDataField

GHSA-62fp-q2t-74d5 · github.com · 2026-07-23

Grav >= 1.7.0

Premium intel

Medium

GetGrav api plugin config write RCE/LPE: Disable Rate Limit and Expand CORS

github.com · 2026-07-23

getgrav/grav-plugin-api <= 1.0.9

Premium intel

High

Path Traversal in GetGrav API Allows Arbitrary File Move

github.com · 2026-07-23

getgrav/grav-plugin-api <= 1.0.9 · grav/grav 1.0.7

Premium intel

High

Privilege Escalation in getgrav/grav-plugin-api via Invitation groups bypass

github.com · 2026-07-23

getgrav/grav-plugin-api <= 1.0.9

Premium intel

Critical

Privilege Escalation in Grav Login Plugin via Mass-Assignment on Profile Update

GHSA-pm54-mhw-qdjm · github.com · 2026-07-22

getgrav/grav-plugin-login <= 3.8.11

High

Stored XSS in DivShortcode Plugin via Shortcode Core Attribute Handlers

github.com · 2026-07-21

GetGrav Grav 6.2.1

Premium intel

High

Grav CMS RCE via Blueprint::dynamicData() Unrestricted Callable (GHSA-g2p-q2f-74v5)

GHSA-g2p-q2f-74v5 · github.com · 2026-07-21

Grav 2.0.4

Premium intel

High

CVE-2026-6268: Webhook SSRF via Unrestricted cURL Protocols with Local File Read

CVE-2026-6268 · github.com · 2026-07-17

GetGrav/Grav 2.0.3

Premium intel

Critical

Grav Grav-plugin-api Bypass of Authorization (CWE-639) via createApiKey and 2FA Stripping (CVE-2024-8266)

CVE-2024-8266 · github.com · 2026-07-17

getgrav/grav-plugin-api <= 1.0.5

Medium

Grav Flex-Objects Privilege Escalation: api.access User Bypass via Fail-Open Authorization in REST API

github.com · 2026-07-17

grav-plugin-flex-objects <= 1.4.2

Low

Grav Twig Sandbox Authenticated ReDoS via regex_replace (GHSA-37f3-6p89-6qf9) and PoC

GHSA-37f3-6p89-6qf9 · github.com · 2026-07-17

Grav 2.0.1

Premium intel

Critical

Grav 2FA Bypass via 'login.regenerate2FASecret' Task - Pre-Auth Auth Bypass

github.com · 2026-07-17

grav 2.0.3

Premium intel

High

Grav API Plugin JWT Token Leak via URL Query Parameter (CVE-2024-63408)

CVE-2024-63408 · github.com · 2026-07-17

getgrav/grav-plugin-api <= 1.0.0-rc.15

All articles are auto-cleaned (markdown extraction + LLM noise removal) and translated to English by our offline pipeline. Source URL is always preserved at the bottom of each article.

Want a specific source covered? Email us — we add new feeds weekly.

Goal Reached Thanks to every supporter — we hit 100%!

Security Intel Hub 98+