CVE-2026-109325: Grav from 2.0.22
- Severity
- 8.7 (HIGH)
- Vendor
- GRAV FROM
- Affected versions
- Before 2.1.7
- Fixed version
- 2.1.7
- Patch status
- Patched
- Published
- 2026-10-12T17:17:27.860
Why it matters
This matters because the affected product may be exposed on public websites. A vulnerable plugin can create a direct path to site compromise, malicious code deployment, or data theft.
Recommended admin actions
- Review and patch based on exposure, asset criticality, and business impact.
- Check whether the affected WordPress plugin or theme is installed.
- Update, disable, or remove the affected component if present.
- Compare installed versions against the affected version range in the advisory.
- Treat internet-facing systems as higher priority.
Technical summary
Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE_ADDR values. Unauthenticated attackers behind a same-host HTTP proxy can read profiler records exposing system and plugin configuration, secrets, request metadata, and queries.
View the official NVD record for CVE-2026-109325
CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.
VULNERABILITY PULSE
2274 RECORDS
SECURE FEED ACTIVE
| AFFECTED PRODUCT | ACTION | ||
|---|---|---|---|
| CVE-2024-34323 |
an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter
Reporter: CVE
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-55675 |
docs
Reporter: SECURITY-ADVISORIES
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-94603 |
podman PATCH
Reporter: SECURITY-ADVISORIES
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-103849 |
ADOBE
Reporter: PSIRT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-110130 |
Dockhand PATCH
Reporter: DISCLOSURE
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-48382 |
ADOBE
Reporter: PSIRT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-48383 |
ADOBE
Reporter: PSIRT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-90532 |
ADOBE
Reporter: PSIRT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-105899 |
ADOBE
Reporter: PSIRT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-106622 |
ADOBE
Reporter: PSIRT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-106624 |
ADOBE
Reporter: PSIRT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-107594 |
File Upload to Order PATCH
Reporter: CONTACT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-106042 |
Xtraction PATCH
Reporter: 3C1D8AA1-5A33-4EA4-8992-AADD6440AF75
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-109412 |
Neurons Patch for Intune PATCH
Reporter: 3C1D8AA1-5A33-4EA4-8992-AADD6440AF75
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-77459 |
argo-cd PATCH
Reporter: SECURITY-ADVISORIES
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-103848 |
ADOBE
Reporter: PSIRT
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-105895 |
ADOBE
Reporter: PSIRT
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-75732 |
ADOBE
Reporter: PSIRT
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-105903 |
ADOBE
Reporter: PSIRT
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-106612 |
ADOBE
Reporter: PSIRT
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-97381 |
LegacyUpdate PATCH
Reporter: SECURITY-ADVISORIES
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-69227 |
A flaw in Portal for ArcGIS
Reporter: PSIRT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-106173 |
FortiSIEM
Reporter: PSIRT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-37107 |
An issue in HTMLy v.3.1.1
Reporter: CVE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-100202 |
Use after free in Windows Message Queuing Queue Manager
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-100219 |
Use after free in Microsoft QUIC
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-100222 |
Heap-based buffer overflow in Network Policy Server (NPS)
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-102210 |
Heap-based buffer overflow in Windows Text Shaping
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-105010 |
Use after free in Microsoft Windows Search Component
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-105016 |
Heap-based buffer overflow in Microsoft QUIC
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-69634 |
Heap-based buffer overflow in Windows iSCSI
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-69639 |
Heap-based buffer overflow in Windows Libarchive
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-69705 |
Out-of-bounds write in Windows iSCSI
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-69883 |
Use after free in Windows iSCSI
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-69886 |
Heap-based buffer overflow in Windows Imaging Component
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-70024 |
Stack-based buffer overflow in Windows Internet Information Services
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-70096 |
Heap-based buffer overflow in Windows Rich Text Edit Control
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-70147 |
Heap-based buffer overflow in Microsoft PostScript Printer Driver
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-70153 |
Heap-based buffer overflow in Microsoft PostScript Printer Driver
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-70157 |
Heap-based buffer overflow in Windows System Information Console
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-70242 |
Microsoft 365 Apps for Enterprise
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-70291 |
Microsoft 365 Apps for Enterprise
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-70300 |
Untrusted pointer dereference in Microsoft Office Word
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-83517 |
Heap-based buffer overflow in Microsoft Windows Media Foundation
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-83519 |
Heap-based buffer overflow in Windows Error Reporting
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-83578 |
Integer underflow (wrap or wraparound) in Windows PowerShell
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-83693 |
Heap-based buffer overflow in Windows Error Reporting
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-83748 |
Heap-based buffer overflow in Windows Error Reporting
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-83770 |
Heap-based buffer overflow in Windows Text Shaping
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-83780 |
Use after free in Windows CCFFilter Driver
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-83782 |
Heap-based buffer overflow in Windows Shell
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-83862 |
Use after free in Windows Network Load Balancing
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-83869 |
Integer underflow (wrap or wraparound) in DNS Server
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-83910 |
Windows 10 Version 1607
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-83935 |
Heap-based buffer overflow in Microsoft XML
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-84015 |
Heap-based buffer overflow in Remote Access Point-to-Point Protocol (PPP) EAP-TLS
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-85792 |
Remote Code Execution in Windows Routing and Remote Access Service (RRAS)
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-85806 |
Integer underflow (wrap or wraparound) in Network Policy Server (NPS)
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-85809 |
Remote Code Execution in Windows Routing and Remote Access Service (RRAS)
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-85814 |
Heap-based buffer overflow in Microsoft Windows Media Foundation
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-85928 |
Heap-based buffer overflow in Windows Volume Manager Extension Driver
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-88102 |
Use after free in Windows Failover Cluster
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-88156 |
Microsoft 365 Apps for Enterprise
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-88178 |
Use after free in Microsoft Office PowerPoint
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-92909 |
ADOBE
Reporter: PSIRT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-96096 |
Heap-based buffer overflow in Windows Media Player
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-96113 |
Heap-based buffer overflow in DNS Server
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-96219 |
Windows 10 Version 1809
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-96320 |
Heap-based buffer overflow in Windows DHCP Server
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-96864 |
Double free in Microsoft Failover Cluster Virtual Driver
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-96909 |
Heap-based buffer overflow in Windows BitLocker
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-96924 |
Untrusted pointer dereference in Windows OLE
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-96934 |
Use after free in Windows DHCP Server
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-97016 |
Microsoft 365 Apps for Enterprise
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-97749 |
Microsoft 365 Apps for Enterprise
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-97805 |
Out-of-bounds read in Windows Partition Management Driver
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-97814 |
Heap-based buffer overflow in Windows Text Shaping
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-97815 |
Heap-based buffer overflow in Windows Error Reporting
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-97816 |
Use after free in OpenSSH for Windows
Reporter: SECURE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-104252 |
Vitess is a database clustering system for horizontal scaling of MySQL PATCH
Reporter: SECURITY-ADVISORIES
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-110392 |
an OS command ('OS command injection') vulnerability in Samsung Open Source QA-Board
Reporter: PSIRT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-93388 |
Printcart Store – Web to Print Product Designer for WooCommerce
Reporter: SECURITY
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-110002 |
Snazzy Social Media Feed
Reporter: SECURITY
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-97657 |
Abandoned Cart Pro for WooCommerce
Reporter: SECURITY
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-97668 |
Abandoned Cart Pro for WooCommerce
Reporter: SECURITY
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-104800 |
AGE-GATE
Reporter: SECURITY
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-87855 |
JTL-Connector for WooCommerce
Reporter: SECURITY
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-104748 |
SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications
Reporter: SECURITY
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-107424 |
M A Vinoth Kumar Frontend Dashboard frontend-dashboard
Reporter: AUDIT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-108291 |
Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates
Reporter: AUDIT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-16740 |
TR7 ASP: from 1.0.40.236 PATCH
Reporter: ILETISIM
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-16741 |
TR7 ASP: from 1.0.40.236 PATCH
Reporter: ILETISIM
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-108065 |
Channel Software WebAlliance eCommerce [VERSION — missing]
Reporter: CVE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-55183 |
Product identification pending PATCH
Reporter: SECURITY-ADVISORIES
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-102238 |
Product identification pending
Reporter: SECURE
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-90531 |
ADOBE
Reporter: PSIRT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-106620 |
ADOBE
Reporter: PSIRT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-75994 |
ADOBE
Reporter: PSIRT
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-110136 |
Use after free in PDF in Google Chrome PATCH
Reporter: CHROME-CVE-ADMIN
|
9.6
CRITICAL
|
VIEW RECORD |
| CVE-2026-110142 |
Use after free in FileSystem in Google Chrome PATCH
Reporter: CHROME-CVE-ADMIN
|
9.6
CRITICAL
|
VIEW RECORD |
About the Vulnerability Pulse CVE Feed
The Vulnerability Pulse feed tracks live CVE advisories sourced from the National Vulnerability Database and vendor security disclosures. It is designed for SOC analysts, IT administrators, and security teams who need a fast, filterable view of current vulnerabilities without digging through raw NVD data.
How to Use the CVE Advisory Tracker
Use the severity filters to narrow results to Critical or High priority vulnerabilities. Filter by vendor to focus on software and hardware relevant to your environment. Export to CSV for reporting, ticketing, or patch prioritization workflows.
What Is a CVE Advisory?
A CVE (Common Vulnerabilities and Exposures) advisory is a public disclosure of a security vulnerability assigned a unique identifier by MITRE. Advisories include severity scores (CVSS), affected versions, and remediation guidance. Monitoring CVE advisories is a core function of vulnerability management programs and SOC operations.
CVE Analysis & Writeups
For in-depth analysis of specific vulnerabilities, visit the IT Knowledge Bases blog for CVE breakdowns, exploitation analysis, and remediation guidance written for security practitioners.