GH
Product
Ghost
82
CVEs
0
On KEV
9.8
Max CVSS
54
New 30D
Severity mix
Critical 2High 28Medium 45Low 7
Watch
Add Ghost to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-29053 | 9.8 | Mar 5 | Ghost Vulnerable to Remote Code Execution via Malicious Themes Affected: >= 0.7.2, < 6.19.1 |
| CVE-2026-53943 | 9.6 | Jun 24 | Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header Affected: >= 4.0.0, < 6.37.0 |
| CVE-2026-105642 | 8.8 | Oct 5 | Ghost: Remote Code Execution via Bookmark Card Images Affected: >= 6.56.0, < 6.67.0 |
| CVE-2026-103268 | 8.8 | Oct 1 | Ghost 1.0.0 before 6.62.0 Suspension Bypass via Password Reset Affected: 1.0.0 before 6.62.0 |
| CVE-2026-29784 | 8.8 | Mar 7 | Ghost: Incomplete CSRF protections around OTC use Affected: >= 5.101.6, < 6.19.3 |
| CVE-2026-105650 | 8.1 | Oct 5 | Ghost: Stored XSS via oEmbed Photo Responses Affected: >= 2.5.0, < 6.64.0 |
| CVE-2026-104414 | 8.1 | Oct 2 | Ghost from 2.5.0 before 6.64.0 Stored XSS via oEmbed Photo Responses Affected: 2.5.0 before 6.64.0 |
| CVE-2026-103283 | 8.1 | Oct 1 | Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling Affected: 6.20.0 before 6.57.1 |
| CVE-2026-103277 | 8.1 | Oct 1 | Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed Affected: 2.5.0 before 6.34.0 |
| CVE-2026-22595 | 8.1 | Jan 10 | Ghost has Staff Token permission bypass Affected: >= 6.0.0, < 6.11.0; >= 5.121.0, < 5.130.6 |
| CVE-2026-22594 | 8.1 | Jan 10 | Ghost has Staff 2FA bypass Affected: >= 6.0.0, < 6.11.0; >= 5.105.0, < 5.130.6 |
| CVE-2026-103292 | 8.0 | Oct 1 | Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_head Affected: 0.5.3 before 6.50.0 |
| CVE-2026-105675 | 7.5 | Oct 5 | Ghost: Invite Token Disclosure in Ghost Admin API Affected: >= 4.39.0, < 6.64.0 |
| CVE-2026-104416 | 7.5 | Oct 2 | Ghost 4.39.0 before 6.64.0 Invite Token Disclosure via Admin API Affected: 4.39.0 before 6.64.0 |
| CVE-2026-103272 | 7.5 | Oct 1 | Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content API Affected: 2.10.0 before 6.63.0 |
| CVE-2026-103271 | 7.5 | Oct 1 | Ghost 4.0.0 before 6.63.0 Restricted Content Bypass Affected: 4.0.0 before 6.63.0 |
| CVE-2026-53950 | 7.5 | Jun 24 | @tryghost/activitypub: XSS in Ghost's ActivityPub client Affected: < 3.1.0 |
| CVE-2026-26980 | 7.5 | Feb 20 | Ghost has a SQL Injection in its Content API Affected: >= 3.24.0, < 6.19.1 |
| CVE-2026-105679 | 7.3 | Oct 5 | Ghost: Stored XSS via File Uploads on Local Storage Affected: >= 6.22.1, < 6.64.0 |
| CVE-2026-105651 | 7.3 | Oct 5 | Ghost: Stored XSS via Bookmark Card Images Affected: >= 5.94.0, < 6.64.0 |
| CVE-2026-105649 | 7.3 | Oct 5 | Ghost: Stored XSS via SVG Uploads Bypassing Sanitization Affected: >= 4.22.0, < 6.65.0 |
| CVE-2026-105643 | 7.3 | Oct 5 | Ghost: Stored XSS via Embed Card Previews Affected: >= 6.34.0, < 6.67.0 |
| CVE-2026-104413 | 7.3 | Oct 2 | Ghost 5.94.0 before 6.64.0 Stored XSS via Bookmark Card Images Affected: 5.94.0 before 6.64.0 |
| CVE-2026-104411 | 7.3 | Oct 2 | Ghost 6.22.1 before 6.64.0 Stored XSS via Local Storage File Uploads Affected: 6.22.1 before 6.64.0 |
| CVE-2026-103286 | 7.3 | Oct 1 | Ghost 2.21.0 before 6.56.0 Privilege Escalation via Notifications Affected: 2.21.0 before 6.56.0 |
| CVE-2026-103278 | 7.3 | Oct 1 | Ghost 5.8.0 before 6.34.0 Staff Account Takeover via Admin iframe Affected: 5.8.0 before 6.34.0 |
| CVE-2026-105677 | 7.2 | Oct 5 | Ghost: Remote Code Execution via Theme Translation Files Affected: >= 6.10.3, < 6.64.0 |
| CVE-2026-104418 | 7.2 | Oct 2 | Ghost from 6.10.3 before 6.64.0 RCE via Theme Translation Files Affected: 6.10.3 before 6.64.0 |
| CVE-2026-22596 | 7.2 | Jan 10 | Ghost has SQL Injection in Members Activity Feed Affected: >= 6.0.0, < 6.11.0; >= 5.90.0, < 5.130.6 |
| CVE-2026-103266 | 7.1 | Oct 1 | Ghost 5.2.0 before 6.62.0 Unauthenticated Stripe Checkout Account Modification Affected: 5.2.0 before 6.62.0 |
| CVE-2026-105644 | 6.8 | Oct 5 | Ghost: Stored XSS via SVG Files in Content Imports Affected: >= 4.0.0, < 6.67.0 |
| CVE-2026-103279 | 6.8 | Oct 1 | Ghost 3.10.0 before 6.34.0 Session Invalidation Bypass Affected: 3.10.0 before 6.34.0 |
| CVE-2026-70594 | 6.7 | Aug 4 | Ghost: Session Fixation in Ghost Admin Affected: >= 2.2.0, < 6.54.1 |
| CVE-2026-70593 | 6.6 | Aug 4 | Ghost: Theme Upload Path Traversal Affected: >= 0.10.0, < 6.54.1 |
| CVE-2026-105681 | 6.5 | Oct 5 | Ghost: Authorization Bypass in Comments Feature Affected: >= 5.9.0, < 6.44.1 |
| CVE-2026-105680 | 6.5 | Oct 5 | Ghost: Authorization Issue Allowed Author Role to Delete any Post Affected: >= 5.81.0, < 6.60.0 |
| CVE-2026-103289 | 6.5 | Oct 1 | Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments Affected: 5.9.0 before 6.44.1 |
| CVE-2026-103288 | 6.5 | Oct 1 | Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like Affected: 5.9.0 before 6.44.1 |
| CVE-2024-43409 | 6.5 | Aug 20 | Ghost's improper authentication allows access to member information and actions Affected: >= 4.46.0 < 5.89.5 |
| CVE-2023-40028 | 6.5 | Aug 15 | Arbitrary file read via symlinks in Ghost Affected: < 5.59.1 |
| CVE-2026-103291 | 6.4 | Oct 1 | Ghost 3.20.2 before 6.51.0 SSRF via image-size fetch Affected: 3.20.2 before 6.51.0 |
| CVE-2026-24778 | 6.1 | Jan 27 | Ghost vulnerable to XSS via malicious Portal preview links Affected: @tryghost/portal >= 2.29.1, < 2.51.5; @tryghost/portal >= 2.52.0, < 2.57.1; ghost >= 5.43.0, < 5.121.0; ghost >= 6.0.0, < 6.15.0 |
| CVE-2026-53944 | 5.8 | Jun 24 | Ghost: Private IP filtering bypass to make server-side requests to internal services Affected: >= 6.0.9, < 6.21.1 |
| CVE-2026-70592 | 5.5 | Aug 4 | Ghost: Database Backup Path Traversal Affected: >= 1.20.1, < 6.54.1 |
| CVE-2026-103281 | 5.4 | Oct 1 | Ghost 3.23.0 before 6.23.0 API Key Exposure via Admin API Affected: 3.23.0 before 6.23.0 |
| CVE-2026-53946 | 5.4 | Jun 24 | Ghost: Mobiledoc image-size fetch SSRF Affected: >= 6.19.4, < 6.21.1 |
| CVE-2026-53948 | 5.4 | Jun 24 | Ghost: File Upload Content-Type Spoofing Affected: >= 6.19.4, < 6.21.1 |
| CVE-2026-103280 | 5.3 | Oct 1 | Ghost 0.8.0 before 6.23.0 Information Disclosure via Setup Endpoint Affected: 0.8.0 before 6.23.0 |
| CVE-2026-103276 | 5.3 | Oct 1 | Ghost before 6.20.0 File Read via URL Encoding Bypass Affected: before 6.20.0 |
| CVE-2026-103274 | 5.3 | Oct 1 | Ghost 5.3.0 before 6.58.0 Unauthenticated Comment Read Affected: 5.3.0 before 6.58.0 |