TryGhost Ghost

• CVE-2026-103269 Medium 5.3 Ghost 5.3.0 before 6.62.0 Missing Authorization via Post Excerpts 0.2%
• CVE-2026-103268 High 8.8 Ghost 1.0.0 before 6.62.0 Suspension Bypass via Password Reset 0.3%
• CVE-2026-103267 Medium 4.3 Ghost 0.5.0 before 6.62.0 Arbitrary Email Registration via Staff Invite 0.3%
• CVE-2026-103266 High 7.1 Ghost 5.2.0 before 6.62.0 Unauthenticated Stripe Checkout Account Modification 0.3%
• CVE-2026-70596 Medium 4.3 Ghost: Cross-Site Scripting in Feature Image Captions 0.3%
• CVE-2026-70595 Medium 4.0 Ghost: Server-Side Request Forgery Mitigation Issue 0.3%
• CVE-2026-70594 Medium 6.7 Ghost: Session Fixation in Ghost Admin 0.2%
• CVE-2026-70593 Medium 6.6 Ghost: Theme Upload Path Traversal 0.4%
• CVE-2026-70592 Medium 5.5 Ghost: Database Backup Path Traversal 0.4%
• CVE-2026-70591 Medium 4.1 Ghost: Server-Side Request Forgery in Image Fetching 0.4%
• CVE-2026-70590 Medium 4.8 Ghost: Blind Password Hash Disclosure in Ghost Admin API 0.3%
• CVE-2026-70589 Medium 4.8 Ghost: Archived Offers can be Redeemed 0.3%
• CVE-2026-70588 Medium 5.0 Ghost: Cross-Site Scripting in Universal Import 0.4%
• CVE-2026-59817 Medium 5.3 Ghost: Paid gift memberships obtainable at minimal cost via the donations feature 0.4%
• CVE-2026-53943 Critical 9.6 Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header 0.4%
• CVE-2026-53944 Medium 5.8 Ghost: Private IP filtering bypass to make server-side requests to internal services 0.3%
• CVE-2026-53945 Medium 4.0 Ghost: Server-side request forgery via DNS rebinding in external request handling 0.2%
• CVE-2026-53946 Medium 5.4 Ghost: Mobiledoc image-size fetch SSRF 0.2%
• CVE-2026-53947 Medium 5.3 Ghost: Member existence leak via magic link sign-in response 0.3%
• CVE-2026-53948 Medium 5.4 Ghost: File Upload Content-Type Spoofing 0.2%
• CVE-2026-53949 Medium 5.3 Ghost Content API filter bypass reveals private fields 0.4%
• CVE-2026-53950 High 7.5 @tryghost/activitypub: XSS in Ghost's ActivityPub client 0.4%
• CVE-2026-29784 High 7.5 Ghost: Incomplete CSRF protections around OTC use 0.2%
• CVE-2026-29053 High 7.7 Ghost Vulnerable to Remote Code Execution via Malicious Themes 4.9%
• CVE-2026-26980 Critical 9.4 Ghost has a SQL Injection in its Content API 71.1%
• CVE-2026-24778 High 8.8 Ghost vulnerable to XSS via malicious Portal preview links 0.3%
• CVE-2026-22597 Medium 5.1 Ghost has SSRF via External Media Inliner 0.3%
• CVE-2026-22596 Medium 6.7 Ghost has SQL Injection in Members Activity Feed 0.5%
• CVE-2026-22595 High 8.1 Ghost has Staff Token permission bypass 0.5%
• CVE-2026-22594 High 8.1 Ghost has Staff 2FA bypass 1.3%
• CVE-2024-43409 Medium 6.5 Ghost's improper authentication allows access to member information and actions 0.3%
• CVE-2023-40028 Medium 4.9 Arbitrary file read via symlinks in Ghost 69.0%
• CVE-2023-31133 High 7.5 Ghost vulnerable to disclosure of private API fields 45.7%
• CVE-2021-39192 Medium 6.5 Privilege escalation: all users can access Admin-level API keys 1.0%
• CVE-2021-29484 Medium 6.8 DOM XSS in Theme Preview 7.9%