Skip to content
Tryghost Ghost vulnerabilities
-
tryghost ghost
Ghost: Authorization Issue Allowed Author Role to Delete any Post
CVE-2026-105680
Fix available
6.5 Medium
-
tryghost ghost
Ghost: Stored XSS via SVG Uploads Bypassing Sanitization
CVE-2026-105649
Fix available
7.3 High
-
tryghost ghost
Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses
CVE-2026-105648
Fix available
4.0 Medium
-
tryghost ghost
Ghost: Server-Side Request Forgery in Bookmark Fetching
CVE-2026-105647
Fix available
4.0 Medium
-
tryghost ghost
Ghost: Regular Expression Denial of Service in Content Import
CVE-2026-105646
Fix available
4.9 Medium
-
tryghost ghost
Ghost: Regular Expression Denial of Service in External Media Inliner
CVE-2026-105645
Fix available
4.9 Medium
-
tryghost ghost
Ghost: Stored XSS via SVG Files in Content Imports
CVE-2026-105644
Fix available
6.8 Medium
-
tryghost ghost
Ghost: Stored XSS via Embed Card Previews
CVE-2026-105643
Fix available
7.3 High
-
tryghost ghost
Ghost: Remote Code Execution via Bookmark Card Images
CVE-2026-105642
Fix available
8.8 High
-
tryghost ghost
Ghost: Remote Code Execution via Theme Translation Files
CVE-2026-105677
Fix available
7.2 High
-
tryghost ghost
Ghost from 6.10.3 before 6.64.0 RCE via Theme Translation Files
CVE-2026-104418
Fix available
8.6 High
-
tryghost ghost
Ghost: Path Traversal via Locale Setting
CVE-2026-105676
Fix available
4.9 Medium
-
tryghost ghost
Ghost: Invite Token Disclosure in Ghost Admin API
CVE-2026-105675
Fix available
7.5 High
-
tryghost ghost
Ghost 1.20.0 before 6.64.0 Path Traversal via Locale Setting
CVE-2026-104417
Fix available
6.9 Medium
-
tryghost ghost
Ghost 4.39.0 before 6.64.0 Invite Token Disclosure via Admin API
CVE-2026-104416
Fix available
7.7 High
-
tryghost ghost
Ghost: Password Hash Ordering Disclosure in Ghost Admin API
CVE-2026-105652
Fix available
3.1 Low
-
tryghost ghost
Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin API
CVE-2026-104415
Fix available
2.3 Low
-
tryghost ghost
Ghost: Stored XSS via oEmbed Photo Responses
CVE-2026-105650
Fix available
8.1 High
-
tryghost ghost
Ghost: Stored XSS via Bookmark Card Images
CVE-2026-105651
Fix available
7.3 High
-
tryghost ghost
Ghost from 2.5.0 before 6.64.0 Stored XSS via oEmbed Photo Responses
CVE-2026-104414
Fix available
8.6 High
-
tryghost ghost
Ghost 5.94.0 before 6.64.0 Stored XSS via Bookmark Card Images
CVE-2026-104413
Fix available
8.5 High
-
tryghost ghost
Ghost: Editors Could Promote Staff Users to Their Own Role
CVE-2026-105678
Fix available
4.3 Medium
-
tryghost ghost
Ghost 0.5.0 before 6.64.0 Privilege Escalation via Staff Role Assignment
CVE-2026-104412
Fix available
5.3 Medium
-
tryghost ghost
Ghost: Stored XSS via File Uploads on Local Storage
CVE-2026-105679
Fix available
7.3 High
-
tryghost ghost
Ghost 6.22.1 before 6.64.0 Stored XSS via Local Storage File Uploads
CVE-2026-104411
Fix available
8.5 High
-
tryghost ghost
Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_head
CVE-2026-103292
Fix available
8.6 High
-
tryghost ghost
Ghost 3.20.2 before 6.51.0 SSRF via image-size fetch
CVE-2026-103291
Fix available
5.3 Medium
-
tryghost ghost
Ghost: Path Traversal Vulnerability in Ghost ImageSize Service
CVE-2026-105683
Fix available
3.8 Low
-
tryghost ghost
Ghost: Authorization Bypass in Comments Feature
CVE-2026-105681
Fix available
6.5 Medium
-
tryghost ghost
Ghost 6.14.0 before 6.27.0 Path Traversal via ImageSize
CVE-2026-103290
Fix available
5.1 Medium
-
tryghost ghost
Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments
CVE-2026-103289
Fix available
7.1 High
-
tryghost ghost
Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like
CVE-2026-103288
Fix available
7.1 High
-
tryghost ghost
Ghost: Server-Side Request Forgery in Webhook Trigger
CVE-2026-105682
Fix available
2.7 Low
-
tryghost ghost
Ghost 1.18.0 before 6.27.0 Server-Side Request Forgery via Webhook
CVE-2026-103287
Fix available
5.1 Medium
-
tryghost ghost
Ghost 2.21.0 before 6.56.0 Privilege Escalation via Notifications
CVE-2026-103286
Fix available
8.5 High
-
tryghost ghost
Ghost 5.19.0 before 6.57.1 Cross-Site Request Forgery
CVE-2026-103285
Fix available
5.3 Medium
-
tryghost ghost
Ghost 5.125.1 before 6.57.1 Information Disclosure via Feedback
CVE-2026-103284
Fix available
5.3 Medium
-
tryghost ghost
Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling
CVE-2026-103283
Fix available
8.6 High
-
tryghost ghost
Ghost 0.5.0 before 6.23.0 Multiple Account Creation via Invite Token
CVE-2026-103282
Fix available
5.3 Medium
-
tryghost ghost
Ghost 3.23.0 before 6.23.0 API Key Exposure via Admin API
CVE-2026-103281
Fix available
5.3 Medium
-
tryghost ghost
Ghost 0.8.0 before 6.23.0 Information Disclosure via Setup Endpoint
CVE-2026-103280
Fix available
6.9 Medium
-
tryghost ghost
Ghost 3.10.0 before 6.34.0 Session Invalidation Bypass
CVE-2026-103279
Fix available
7.6 High
-
tryghost ghost
Ghost 5.8.0 before 6.34.0 Staff Account Takeover via Admin iframe
CVE-2026-103278
Fix available
8.5 High
-
tryghost ghost
Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed
CVE-2026-103277
Fix available
8.6 High
-
tryghost ghost
Ghost before 6.20.0 File Read via URL Encoding Bypass
CVE-2026-103276
Fix available
6.9 Medium
-
tryghost ghost
Ghost 5.42.2 before 6.58.0 Password Hash Disclosure
CVE-2026-103275
Fix available
5.3 Medium
-
tryghost ghost
Ghost 5.3.0 before 6.58.0 Unauthenticated Comment Read
CVE-2026-103274
Fix available
6.9 Medium
-
tryghost ghost
Ghost 4.3.0 before 6.58.0 Incorrect Authorization via Staff Token
CVE-2026-103273
Fix available
5.3 Medium
-
tryghost ghost
Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content API
CVE-2026-103272
Fix available
8.7 High
-
tryghost ghost
Ghost 4.0.0 before 6.63.0 Restricted Content Bypass
CVE-2026-103271
Fix available
8.7 High
- Show olderLoading…