Common/Grav.php in Grav before 1.7 has an Open Redirect. This is partially fixed in 1.6.23 and still present in 1.6.x.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-11529.json"