TryGhost Ghost

• CVE-2026-105683 Low 3.8 Ghost: Path Traversal Vulnerability in Ghost ImageSize Service 0.3%
• CVE-2026-105682 Low 2.7 Ghost: Server-Side Request Forgery in Webhook Trigger 0.2%
• CVE-2026-105681 Medium 6.5 Ghost: Authorization Bypass in Comments Feature 0.3%
• CVE-2026-105680 Medium 6.5 Ghost: Authorization Issue Allowed Author Role to Delete any Post 0.3%
• CVE-2026-105679 High 7.3 Ghost: Stored XSS via File Uploads on Local Storage 0.2%
• CVE-2026-105678 Medium 4.3 Ghost: Editors Could Promote Staff Users to Their Own Role 0.2%
• CVE-2026-105677 High 7.2 Ghost: Remote Code Execution via Theme Translation Files 0.5%
• CVE-2026-105676 Medium 4.9 Ghost: Path Traversal via Locale Setting 0.4%
• CVE-2026-105675 High 7.5 Ghost: Invite Token Disclosure in Ghost Admin API 0.4%
• CVE-2026-105652 Low 3.1 Ghost: Password Hash Ordering Disclosure in Ghost Admin API 0.3%
• CVE-2026-105651 High 7.3 Ghost: Stored XSS via Bookmark Card Images 0.3%
• CVE-2026-105650 High 8.1 Ghost: Stored XSS via oEmbed Photo Responses 0.3%
• CVE-2026-105649 High 7.3 Ghost: Stored XSS via SVG Uploads Bypassing Sanitization 0.3%
• CVE-2026-105648 Medium 4.0 Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses 0.3%
• CVE-2026-105647 Medium 4.0 Ghost: Server-Side Request Forgery in Bookmark Fetching 0.2%
• CVE-2026-105646 Medium 4.9 Ghost: Regular Expression Denial of Service in Content Import 0.3%
• CVE-2026-105645 Medium 4.9 Ghost: Regular Expression Denial of Service in External Media Inliner 0.3%
• CVE-2026-105644 Medium 6.8 Ghost: Stored XSS via SVG Files in Content Imports 0.3%
• CVE-2026-105643 High 7.3 Ghost: Stored XSS via Embed Card Previews 0.3%
• CVE-2026-105642 High 8.8 Ghost: Remote Code Execution via Bookmark Card Images 0.3%
• CVE-2026-104418 High 7.2 Ghost from 6.10.3 before 6.64.0 RCE via Theme Translation Files 0.7%
• CVE-2026-104417 Medium 4.9 Ghost 1.20.0 before 6.64.0 Path Traversal via Locale Setting 0.4%
• CVE-2026-104416 High 7.5 Ghost 4.39.0 before 6.64.0 Invite Token Disclosure via Admin API 0.3%
• CVE-2026-104415 Low 3.1 Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin API 0.2%
• CVE-2026-104414 High 8.1 Ghost from 2.5.0 before 6.64.0 Stored XSS via oEmbed Photo Responses 0.3%
• CVE-2026-104413 High 7.3 Ghost 5.94.0 before 6.64.0 Stored XSS via Bookmark Card Images 0.3%
• CVE-2026-104412 Medium 4.3 Ghost 0.5.0 before 6.64.0 Privilege Escalation via Staff Role Assignment 0.2%
• CVE-2026-104411 High 7.3 Ghost 6.22.1 before 6.64.0 Stored XSS via Local Storage File Uploads 0.3%
• CVE-2026-103292 High 8.0 Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_head 0.2%
• CVE-2026-103291 Medium 6.4 Ghost 3.20.2 before 6.51.0 SSRF via image-size fetch 0.1%
• CVE-2026-103290 Low 3.8 Ghost 6.14.0 before 6.27.0 Path Traversal via ImageSize 0.3%
• CVE-2026-103289 Medium 6.5 Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments 0.2%
• CVE-2026-103288 Medium 6.5 Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like 0.2%
• CVE-2026-103287 Low 2.7 Ghost 1.18.0 before 6.27.0 Server-Side Request Forgery via Webhook 0.2%
• CVE-2026-103286 High 7.3 Ghost 2.21.0 before 6.56.0 Privilege Escalation via Notifications 0.2%
• CVE-2026-103285 Medium 4.3 Ghost 5.19.0 before 6.57.1 Cross-Site Request Forgery 0.1%
• CVE-2026-103284 Medium 4.3 Ghost 5.125.1 before 6.57.1 Information Disclosure via Feedback 0.2%
• CVE-2026-103283 High 8.1 Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling 0.3%
• CVE-2026-103282 Medium 4.3 Ghost 0.5.0 before 6.23.0 Multiple Account Creation via Invite Token 0.1%
• CVE-2026-103281 Medium 5.4 Ghost 3.23.0 before 6.23.0 API Key Exposure via Admin API 0.2%
• CVE-2026-103280 Medium 5.3 Ghost 0.8.0 before 6.23.0 Information Disclosure via Setup Endpoint 0.2%
• CVE-2026-103279 Medium 6.8 Ghost 3.10.0 before 6.34.0 Session Invalidation Bypass 0.2%
• CVE-2026-103278 High 7.3 Ghost 5.8.0 before 6.34.0 Staff Account Takeover via Admin iframe 0.3%
• CVE-2026-103277 High 8.1 Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed 0.3%
• CVE-2026-103276 Medium 5.3 Ghost before 6.20.0 File Read via URL Encoding Bypass 0.2%
• CVE-2026-103275 Medium 4.3 Ghost 5.42.2 before 6.58.0 Password Hash Disclosure 0.2%
• CVE-2026-103274 Medium 5.3 Ghost 5.3.0 before 6.58.0 Unauthenticated Comment Read 0.2%
• CVE-2026-103273 Medium 4.3 Ghost 4.3.0 before 6.58.0 Incorrect Authorization via Staff Token 0.3%
• CVE-2026-103272 High 7.5 Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content API 0.4%
• CVE-2026-103271 High 7.5 Ghost 4.0.0 before 6.63.0 Restricted Content Bypass 0.4%