GH
Product
Ghost
80
CVEs
0
On KEV
9.8
Max CVSS
54
New 30D
Severity mix
Critical 2High 28Medium 43Low 7
Watch
Add Ghost to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-53947 | 5.3 | Jun 24 | Ghost: Member existence leak via magic link sign-in response Affected: >= 5.18.0, < 6.21.1 |
| CVE-2026-53949 | 5.3 | Jun 24 | Ghost Content API filter bypass reveals private fields Affected: >= 5.46.1, < 6.21.2 |
| CVE-2026-70588 | 5.0 | Aug 4 | Ghost: Cross-Site Scripting in Universal Import Affected: >= 5.26.0, < 6.54.1 |
| CVE-2026-105676 | 4.9 | Oct 5 | Ghost: Path Traversal via Locale Setting Affected: >= 1.20.0, < 6.64.0 |
| CVE-2026-105646 | 4.9 | Oct 5 | Ghost: Regular Expression Denial of Service in Content Import Affected: >= 4.0.0, < 6.67.0 |
| CVE-2026-105645 | 4.9 | Oct 5 | Ghost: Regular Expression Denial of Service in External Media Inliner Affected: >= 5.37.0, < 6.67.0 |
| CVE-2026-104417 | 4.9 | Oct 2 | Ghost 1.20.0 before 6.64.0 Path Traversal via Locale Setting Affected: 1.20.0 before 6.64.0 |
| CVE-2026-70590 | 4.8 | Aug 4 | Ghost: Blind Password Hash Disclosure in Ghost Admin API Affected: < 6.54.1 |
| CVE-2026-70589 | 4.8 | Aug 4 | Ghost: Archived Offers can be Redeemed Affected: >= 4.22.0, < 6.54.1 |
| CVE-2026-105678 | 4.3 | Oct 5 | Ghost: Editors Could Promote Staff Users to Their Own Role Affected: >= 0.5.0, < 6.64.0 |
| CVE-2026-104412 | 4.3 | Oct 2 | Ghost 0.5.0 before 6.64.0 Privilege Escalation via Staff Role Assignment Affected: 0.5.0 before 6.64.0 |
| CVE-2026-103285 | 4.3 | Oct 1 | Ghost 5.19.0 before 6.57.1 Cross-Site Request Forgery Affected: 5.19.0 before 6.57.1 |
| CVE-2026-103284 | 4.3 | Oct 1 | Ghost 5.125.1 before 6.57.1 Information Disclosure via Feedback Affected: 5.125.1 before 6.57.1 |
| CVE-2026-103282 | 4.3 | Oct 1 | Ghost 0.5.0 before 6.23.0 Multiple Account Creation via Invite Token Affected: 0.5.0 before 6.23.0 |
| CVE-2026-103275 | 4.3 | Oct 1 | Ghost 5.42.2 before 6.58.0 Password Hash Disclosure Affected: 5.42.2 before 6.58.0 |
| CVE-2026-103273 | 4.3 | Oct 1 | Ghost 4.3.0 before 6.58.0 Incorrect Authorization via Staff Token Affected: 4.3.0 before 6.58.0 |
| CVE-2026-103267 | 4.3 | Oct 1 | Ghost 0.5.0 before 6.62.0 Arbitrary Email Registration via Staff Invite Affected: 0.5.0 before 6.62.0 |
| CVE-2026-70596 | 4.3 | Aug 5 | Ghost: Cross-Site Scripting in Feature Image Captions Affected: >= 4.9.0, < 6.54.1 |
| CVE-2026-70591 | 4.1 | Aug 4 | Ghost: Server-Side Request Forgery in Image Fetching Affected: >= 0.10.0, < 6.54.1 |
| CVE-2026-105648 | 4.0 | Oct 5 | Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses Affected: >= 6.0.9, < 6.65.0 |
| CVE-2026-105647 | 4.0 | Oct 5 | Ghost: Server-Side Request Forgery in Bookmark Fetching Affected: >= 6.54.1, < 6.65.0 |
| CVE-2026-70595 | 4.0 | Aug 5 | Ghost: Server-Side Request Forgery Mitigation Issue Affected: >= 6.26.0, < 6.54.1 |
| CVE-2026-53945 | 4.0 | Jun 24 | Ghost: Server-side request forgery via DNS rebinding in external request handling Affected: >= 6.0.9, < 6.21.1 |
| CVE-2026-105683 | 3.8 | Oct 5 | Ghost: Path Traversal Vulnerability in Ghost ImageSize Service Affected: >= 6.14.0, < 6.27.0 |
| CVE-2026-103290 | 3.8 | Oct 1 | Ghost 6.14.0 before 6.27.0 Path Traversal via ImageSize Affected: 6.14.0 before 6.27.0 |
| CVE-2026-105652 | 3.1 | Oct 5 | Ghost: Password Hash Ordering Disclosure in Ghost Admin API Affected: >= 0.7.2, < 6.64.0 |
| CVE-2026-104415 | 3.1 | Oct 2 | Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin API Affected: 0.7.2 before 6.64.0 |
| CVE-2026-105682 | 2.7 | Oct 5 | Ghost: Server-Side Request Forgery in Webhook Trigger Affected: >= 1.18.0, < 6.27.0 |
| CVE-2026-103287 | 2.7 | Oct 1 | Ghost 1.18.0 before 6.27.0 Server-Side Request Forgery via Webhook Affected: 1.18.0 before 6.27.0 |
| CVE-2026-22597 | 2.7 | Jan 10 | Ghost has SSRF via External Media Inliner Affected: >= 6.0.0, < 6.11.0; >= 5.38.0, < 5.130.6 |