Skip to content
Threat Feed
Subscribe

Product

Grav (< 2.1.7)

1 brief RSS
high advisory

Authentication Bypass in Grav Clockwork Profiler

Grav versions 2.0.22 through 2.1.6 are vulnerable to an authentication bypass in the Clockwork profiler that trusts loopback REMOTE_ADDR headers, potentially exposing system configuration and secrets.

Grav +5 web-application information-disclosure cve-2026-109326
1t 1c