Skip to content
OpenAdvisories

Package · Packagist

getgrav/grav

99 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 3.7
    CVE-2026-72701

    Grav CMS before 2.0.16 Timing Attack via verifyNonce

    Grav CMS before 2.0.16 contains a timing vulnerability in Utils::verifyNonce() that uses non-constant-time string comparison with the === operator instead of hash_equals() for CSRF nonce validation. Attackers can measure response timing differences to recover…

    getgrav grav getgrav/grav Packagist