GH
Product
Ghost
72
CVEs
0
On KEV
9.6
Max CVSS
54
New 30D
Severity mix
Critical 1High 23Medium 42Low 6
Watch
Add Ghost to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-105642 | 8.8 | Oct 5 | Ghost: Remote Code Execution via Bookmark Card Images Affected: >= 6.56.0, < 6.67.0 |
| CVE-2026-103268 | 8.8 | Oct 1 | Ghost 1.0.0 before 6.62.0 Suspension Bypass via Password Reset Affected: 1.0.0 before 6.62.0 |
| CVE-2026-105650 | 8.1 | Oct 5 | Ghost: Stored XSS via oEmbed Photo Responses Affected: >= 2.5.0, < 6.64.0 |
| CVE-2026-104414 | 8.1 | Oct 2 | Ghost from 2.5.0 before 6.64.0 Stored XSS via oEmbed Photo Responses Affected: 2.5.0 before 6.64.0 |
| CVE-2026-103283 | 8.1 | Oct 1 | Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling Affected: 6.20.0 before 6.57.1 |
| CVE-2026-103277 | 8.1 | Oct 1 | Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed Affected: 2.5.0 before 6.34.0 |
| CVE-2026-103292 | 8.0 | Oct 1 | Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_head Affected: 0.5.3 before 6.50.0 |
| CVE-2026-105675 | 7.5 | Oct 5 | Ghost: Invite Token Disclosure in Ghost Admin API Affected: >= 4.39.0, < 6.64.0 |
| CVE-2026-104416 | 7.5 | Oct 2 | Ghost 4.39.0 before 6.64.0 Invite Token Disclosure via Admin API Affected: 4.39.0 before 6.64.0 |
| CVE-2026-103272 | 7.5 | Oct 1 | Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content API Affected: 2.10.0 before 6.63.0 |
| CVE-2026-103271 | 7.5 | Oct 1 | Ghost 4.0.0 before 6.63.0 Restricted Content Bypass Affected: 4.0.0 before 6.63.0 |
| CVE-2026-53950 | 7.5 | Jun 24 | @tryghost/activitypub: XSS in Ghost's ActivityPub client Affected: < 3.1.0 |
| CVE-2026-105679 | 7.3 | Oct 5 | Ghost: Stored XSS via File Uploads on Local Storage Affected: >= 6.22.1, < 6.64.0 |
| CVE-2026-105651 | 7.3 | Oct 5 | Ghost: Stored XSS via Bookmark Card Images Affected: >= 5.94.0, < 6.64.0 |
| CVE-2026-105649 | 7.3 | Oct 5 | Ghost: Stored XSS via SVG Uploads Bypassing Sanitization Affected: >= 4.22.0, < 6.65.0 |
| CVE-2026-105643 | 7.3 | Oct 5 | Ghost: Stored XSS via Embed Card Previews Affected: >= 6.34.0, < 6.67.0 |
| CVE-2026-104413 | 7.3 | Oct 2 | Ghost 5.94.0 before 6.64.0 Stored XSS via Bookmark Card Images Affected: 5.94.0 before 6.64.0 |
| CVE-2026-104411 | 7.3 | Oct 2 | Ghost 6.22.1 before 6.64.0 Stored XSS via Local Storage File Uploads Affected: 6.22.1 before 6.64.0 |
| CVE-2026-103286 | 7.3 | Oct 1 | Ghost 2.21.0 before 6.56.0 Privilege Escalation via Notifications Affected: 2.21.0 before 6.56.0 |
| CVE-2026-103278 | 7.3 | Oct 1 | Ghost 5.8.0 before 6.34.0 Staff Account Takeover via Admin iframe Affected: 5.8.0 before 6.34.0 |
| CVE-2026-105677 | 7.2 | Oct 5 | Ghost: Remote Code Execution via Theme Translation Files Affected: >= 6.10.3, < 6.64.0 |
| CVE-2026-104418 | 7.2 | Oct 2 | Ghost from 6.10.3 before 6.64.0 RCE via Theme Translation Files Affected: 6.10.3 before 6.64.0 |
| CVE-2026-103266 | 7.1 | Oct 1 | Ghost 5.2.0 before 6.62.0 Unauthenticated Stripe Checkout Account Modification Affected: 5.2.0 before 6.62.0 |
Showing 23