CVE-2026-109314

Published 12 October 2026 · tracked since 13 October 2026

Description

Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain password-reset tokens by authoring a page at the reset route. When a victim opens an emailed reset link, the publisher-controlled page rendered by Login::getPage() exposes the usern

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-109313 HIGH 8.1
• CVE-2026-109309 MEDIUM 6.5
• CVE-2026-109312 HIGH 8.1
• CVE-2026-109305 HIGH 8.8
• CVE-2026-109293 MEDIUM 6.5
• CVE-2026-109266 MEDIUM 5.3
• CVE-2026-109237 HIGH 8.1
• CVE-2026-109238 HIGH 8.6
• CVE-2026-109239 MEDIUM 5.3
• CVE-2026-105274

→ Open the live CVE board · all tools