GH
Product
Ghost
31
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 11Medium 14Low 1
Watch
Add Ghost to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-29784 | 8.8 | Mar 7 | Ghost: Incomplete CSRF protections around OTC use Affected: 5.101.6 before 6.19.3 |
| CVE-2024-34448 | 8.8 | May 22 | Ghost before 5.82.0 allows CSV Injection during a member CSV export Affected: before 5.82.0 |
| CVE-2026-22595 | 8.1 | Jan 10 | Ghost has Staff Token permission bypass Affected: 5.121.0 before 5.130.6; 6.0.0 before 6.11.0 |
| CVE-2026-22594 | 8.1 | Jan 10 | Ghost has Staff 2FA bypass Affected: 5.105.0 before 5.130.6; 6.0.0 before 6.11.0 |
| CVE-2020-8134 | 8.1 | Mar 20 | Server-side request forgery (SSRF) vulnerability in Ghost CMS < 3.10.0 allows an attacker to scan local or external network or otherwise interact with internal systems Affected: before 3.10.0 |
| CVE-2026-26980 | 7.5 | Feb 20 | Ghost has a SQL Injection in its Content API Affected: 3.24.0 before 6.19.1 |
| CVE-2024-34559 | 7.5 | May 9 | WordPress Ghost plugin <= 1.4.0 - Sensitive Data Exposure via Log File vulnerability Affected: through 1.4.0 |
| CVE-2023-31133 | 7.5 | May 8 | Ghost vulnerable to disclosure of private API fields Affected: before 5.46.1 |
| CVE-2023-32235 | 7.5 | May 5 | Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory traversal Affected: before 5.42.1 |
| CVE-2026-22596 | 7.2 | Jan 10 | Ghost has SQL Injection in Members Activity Feed Affected: 5.90.0 before 5.130.6; 6.0.0 before 6.11.0 |
| CVE-2021-39192 | 7.2 | Sep 3 | Ghost is a Node.js content management system Affected: 4.0.0 before 4.10.0 |
Showing 11