Skip to contentTryghost Ghost vulnerabilities
- tryghost ghostGhost 5.3.0 before 6.62.0 Missing Authorization via Post ExcerptsCVE-2026-103269Fix available6.9 Medium
- tryghost ghostGhost 1.0.0 before 6.62.0 Suspension Bypass via Password ResetCVE-2026-103268Fix available8.7 High
- tryghost ghostGhost 0.5.0 before 6.62.0 Arbitrary Email Registration via Staff InviteCVE-2026-103267Fix available5.3 Medium
- tryghost ghostGhost 5.2.0 before 6.62.0 Unauthenticated Stripe Checkout Account ModificationCVE-2026-103266Fix available7.1 High
- ghost foundation ghostGhost Foundation Ghost - Broken Access ControlCVE-2026-725968.1 High
- tryghost ghostGhost: Cross-Site Scripting in Feature Image CaptionsCVE-2026-70596Fix available4.3 Medium
- tryghost ghostGhost: Server-Side Request Forgery Mitigation IssueCVE-2026-70595Fix available4.0 Medium
- tryghost ghostGhost: Session Fixation in Ghost AdminCVE-2026-70594Fix available6.7 Medium
- tryghost ghostGhost: Theme Upload Path TraversalCVE-2026-70593Fix available6.6 Medium
- tryghost ghostGhost: Database Backup Path TraversalCVE-2026-70592Fix available5.5 Medium
- tryghost ghostGhost: Server-Side Request Forgery in Image FetchingCVE-2026-70591Fix available4.1 Medium
- tryghost ghostGhost: Blind Password Hash Disclosure in Ghost Admin APICVE-2026-70590Fix available4.8 Medium
- tryghost ghostGhost: Archived Offers can be RedeemedCVE-2026-70589Fix available4.8 Medium
- tryghost ghostGhost: Cross-Site Scripting in Universal ImportCVE-2026-70588Fix available5.0 Medium
- tryghost ghost-cliGhost CLI < 1.30.1 IP Spoofing via X-Forwarded-For HeaderCVE-2026-25552Fix available6.3 Medium
- tryghost ghostGhost: Paid gift memberships obtainable at minimal cost via the donations featureCVE-2026-59817Fix available5.3 Medium
- tryghost ghostGhost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview headerCVE-2026-53943Fix available9.6 Critical
- tryghost ghostGhost: Private IP filtering bypass to make server-side requests to internal servicesCVE-2026-53944Fix available5.8 Medium
- tryghost ghostGhost: Server-side request forgery via DNS rebinding in external request handlingCVE-2026-53945Fix available4.0 Medium
- tryghost ghostGhost: Mobiledoc image-size fetch SSRFCVE-2026-53946Fix available5.4 Medium
- tryghost ghostGhost: Member existence leak via magic link sign-in responseCVE-2026-53947Fix available5.3 Medium
- tryghost ghostGhost: File Upload Content-Type SpoofingCVE-2026-53948Fix available5.4 Medium
- tryghost ghostGhost Content API filter bypass reveals private fieldsCVE-2026-53949Fix available5.3 Medium
- tryghost ghost@tryghost/activitypub: XSS in Ghost's ActivityPub clientCVE-2026-53950Fix available7.5 High
- ghostGhost: Incomplete CSRF protections around OTC useCVE-2026-29784Fix available7.5 High
- ghostGhost Vulnerable to Remote Code Execution via Malicious ThemesCVE-2026-29053Public exploitFix available7.7 High
- akamai ghostAkamai Ghost on Akamai CDN edge servers before 2026-02-06 mishandles processing of custom hop-by...CVE-2026-263654.0 Medium
- ghostGhost has a SQL Injection in its Content APICVE-2026-26980Public exploitFix availableEPSS 71.1%9.4 Critical
- ghost, ghost portal +1 moreGhost vulnerable to XSS via malicious Portal preview linksCVE-2026-24778Fix available8.8 High
- ghostGhost has SQL Injection in Members Activity FeedCVE-2026-22596Fix available6.7 Medium
- ghostGhost has SSRF via External Media InlinerCVE-2026-22597Fix available5.1 Medium
- ghostGhost has Staff Token permission bypassCVE-2026-22595Fix available8.1 High
- ghostGhost has Staff 2FA bypassCVE-2026-22594Public exploitFix available8.1 High
- ghostGhost 6.0.6 - SSRF via oEmbed BookmarkCVE-2025-9862Fix available6.1 Medium
- ghostGhost's improper authentication allows access to member information and actionsCVE-2024-43409Fix available6.5 Medium
- ghostWordPress Ghost plugin <= 1.4.0 - Sensitive Data Exposure via Log File vulnerabilityCVE-2024-34559Fix available7.5 High
- ghostArbitrary file read via symlinks in GhostCVE-2023-40028Public exploitFix availableEPSS 65.7%4.9 Medium
- ghostGhost vulnerable to disclosure of private API fieldsCVE-2023-31133Fix availableEPSS 45.7%7.5 High
- ghostAn insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation...CVE-2022-47197Fix available9.0 Critical
- ghostAn insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation...CVE-2022-47196Fix available9.0 Critical
- ghostAn insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation...CVE-2022-47195Fix available9.0 Critical
- ghostAn insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation...CVE-2022-47194Fix available9.0 Critical
- ghostA user enumeration vulnerability exists in the login functionality of Ghost Foundation Ghost 5.9...CVE-2022-41697Fix availableEPSS 20.0%5.3 Medium
- ghostghost vulnerable to unauthorized newsletter modification via improper access controlsCVE-2022-41654Fix availableEPSS 18.9%9.6 Critical
- ghostPrivilege escalation: all users can access Admin-level API keysCVE-2021-39192Fix available6.5 Medium
- ghostDOM XSS in Theme PreviewCVE-2021-29484Fix available6.8 Medium
- ghostServer-side request forgery in Ghost CMSCVE-2020-8134Fix available8.1 High