CVE WATCH / VULNERABILITY DETAIL
CVE-2026-112779
CRITICALCVSS 9.8NVD feed
Published 19 October 2026 · tracked since 20 October 2026
Description
Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/translations/{lang} endpoint, and 1.0.16 before 1.0.42 fails to check target and destination page rules in the sync and batch copy e
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog