Skip to content
Ghost vulnerabilities
Newest
-
ghost
Ghost: Incomplete CSRF protections around OTC use
CVE-2026-29784
Fix available
7.5 High
-
ghost
Ghost Vulnerable to Remote Code Execution via Malicious Themes
CVE-2026-29053
Public exploitFix available
7.7 High
-
ghost
Ghost has a SQL Injection in its Content API
CVE-2026-26980
Public exploitFix available
EPSS 71.1%
9.4 Critical
-
ghost, ghost portal +1 more
Ghost vulnerable to XSS via malicious Portal preview links
CVE-2026-24778
Fix available
8.8 High
-
ghost
Ghost has SQL Injection in Members Activity Feed
CVE-2026-22596
Fix available
6.7 Medium
-
ghost
Ghost has SSRF via External Media Inliner
CVE-2026-22597
Fix available
5.1 Medium
-
ghost
Ghost has Staff Token permission bypass
CVE-2026-22595
Fix available
8.1 High
-
ghost
Ghost has Staff 2FA bypass
CVE-2026-22594
Public exploitFix available
8.1 High
-
ghost
Ghost 6.0.6 - SSRF via oEmbed Bookmark
CVE-2025-9862
Fix available
6.1 Medium
-
ghost
Ghost's improper authentication allows access to member information and actions
CVE-2024-43409
Fix available
6.5 Medium
-
ghost
Ghost through 5.85.1 allows remote attackers to bypass an authentication rate-limit protection...
CVE-2024-34451
Fix availableDisputed
9.1 Critical
-
ghost
Ghost allows CSV Injection during member CSV export
CVE-2024-34448
Fix available
8.8 High
-
ghost
WordPress Ghost plugin <= 1.4.0 - Sensitive Data Exposure via Log File vulnerability
CVE-2024-34559
Fix available
7.5 High
-
ghost
Ghost has possible Cross-site Scripting issue
CVE-2024-23724
Public exploitFix availableDisputed
9.0 Critical
-
ghost
Cross-site Scripting in Ghost
CVE-2024-23725
Fix available
6.1 Medium
-
ghost
Arbitrary file read via symlinks in Ghost
CVE-2023-40028
Public exploitFix available
EPSS 69.0%
4.9 Medium
-
ghost
Path Traversal in Ghost
CVE-2023-32235
Public exploitFix available
EPSS 39.1%
7.5 High
-
ghost
Ghost vulnerable to disclosure of private API fields
CVE-2023-31133
Fix available
EPSS 45.7%
7.5 High
-
ghost sqlite3
Buffer Overflow vulnerability found in SQLite3 v.3.27.1 and before allows a local attacker to...
CVE-2020-24736
Fix available
5.5 Medium
-
ghost sqlite3, ghost foundation node-sqlite3 +1 more
sqlite vulnerable to code execution due to Object coercion
CVE-2022-43441
Fix available
8.1 High
-
ghost
Ghost 5.35.0 allows authorization bypass: contributors can view draft posts of other users, which...
CVE-2023-26510
Fix available
5.7 Medium
-
ghost
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation...
CVE-2022-47197
Fix available
9.0 Critical
-
ghost
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation...
CVE-2022-47196
Fix available
9.0 Critical
-
ghost
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation...
CVE-2022-47195
Fix available
9.0 Critical
-
ghost
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation...
CVE-2022-47194
Fix available
9.0 Critical
-
ghost
A user enumeration vulnerability exists in the login functionality of Ghost Foundation Ghost 5.9...
CVE-2022-41697
Fix available
EPSS 20.0%
5.3 Medium
-
ghost
ghost vulnerable to unauthorized newsletter modification via improper access controls
CVE-2022-41654
Fix available
EPSS 18.9%
9.6 Critical
-
ghost sqlite3
Denial of Service (DoS)
CVE-2022-21227
Fix available
7.5 High
-
ghost
Arbitrary file upload in Ghost
CVE-2022-28397
Fix availableDisputed
9.8 Critical
-
ghost
Arbitrary file upload in Ghost
CVE-2022-27139
Fix availableDisputed
9.8 Critical
-
ghost
Privilege escalation: all users can access Admin-level API keys
CVE-2021-39192
Fix available
6.5 Medium
-
ghost
DOM XSS in Theme Preview
CVE-2021-29484
Fix available
6.8 Medium
-
ghost
Server-side request forgery in Ghost CMS
CVE-2020-8134
Fix available
8.1 High
-
ghost
The ghost plugin before 0.5.6 for WordPress has no access control for wp-admin/tools.php...
CVE-2016-10983
6.5 Medium