Read the docs

TryGhost

Records110All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical8CVSS 9.0–10.0
CVSS high39CVSS 7.0–8.9

Exploited now

TryGhost records in CISA KEV

No TryGhost vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Ghost 30 records CRITICAL Sqlite3 3 records MEDIUM Portal 1 record MEDIUM

Records

110 records

TI-2026-21459 CVE-2026-26980 · GHSA-w52v-v783-gw97

Ghost has a SQL Injection in its Content API

Priority CRITICAL 86

Ghost is a Node.js content management system.

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.71095 Published 2026-02-20 Fixed in 6.19.1 CWE-89
TI-2023-14843 CVE-2023-31133 · GHSA-r97q-ghch-82j9

Ghost vulnerable to disclosure of private API fields

Priority HIGH 68

Ghost is an app for new-media creators with tools to build a website, publish content, send newsletters, and offer paid subscriptions to members.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.45713 Published 2023-05-08 Fixed in 5.46.1 CWE-200
TI-2025-09049 CVE-2025-9862 · GHSA-f7qg-xj45-w956

Ghost 6.0.6 - SSRF via oEmbed Bookmark

Priority HIGH 66

Server-Side Request Forgery (SSRF) vulnerability in Ghost allows an attacker to access internal resources.This issue affects Ghost: from 6.0.0 through 6.0.8, from 5.99.0 through 5.130.3.

CVSS 4.0MEDIUM 6.1 Network High privileges No interaction EPSS 0.00517 Published 2025-09-17 Fixed in 6.0.9, 5.130.4 CWE-918
TI-2023-20918 CVE-2023-40028 · GHSA-9c9v-w225-v5rg

Arbitrary file read via symlinks in Ghost

Priority HIGH 66

Ghost is an open source content management system.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.68954 Published 2023-08-15 Fixed in 5.59.1 CWE-22
TI-2022-23399 CVE-2022-47196 · GHSA-vx4r-h2xh-2c27

Cross-site scripting in TryGhost Ghost

Priority MEDIUM 60

An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0069 Published 2023-01-19 No fix listed CWE-453
TI-2022-23398 CVE-2022-47195 · GHSA-g78m-xpj3-3hwr

Cross-site scripting in TryGhost Ghost

Priority MEDIUM 60

An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0069 Published 2023-01-19 No fix listed CWE-453
TI-2022-23397 CVE-2022-47194 · GHSA-gfr8-qfh4-r5rc

Cross-site scripting in TryGhost Ghost

Priority MEDIUM 60

An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00824 Published 2023-01-19 No fix listed CWE-453
TI-2022-20049 CVE-2022-41654 · GHSA-9gh8-wp53-ccc6

Improper access control in TryGhost Ghost

Priority MEDIUM 55

An authentication bypass vulnerability exists in the newsletter subscription functionality of Ghost Foundation Ghost 5.9.4.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.18914 Published 2022-12-23 Fixed in 5.22.7, 4.48.8 CWE-284
TI-2024-15729 CVE-2024-23724 · GHSA-99vc-xw8j-phjm

Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a…

Priority MEDIUM 47

Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost…

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.03485 Published 2024-02-11 No fix listed CWE-79
TI-2022-21236 CVE-2022-43441 · GHSA-jqv5-7xpx-qj74

Mass assignment in TryGhost node-sqlite3

Priority MEDIUM 47

A code execution vulnerability exists in the Statement Bindings functionality of Ghost Foundation node-sqlite3 5.1.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02356 Published 2023-03-16 Fixed in 5.1.5 CWE-915
TI-2026-65647 CVE-2026-103272 · GHSA-jh5v-v5x3-c3pp

Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content API

Priority MEDIUM 44

Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauthenticated attackers to leak user data.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00365 Published 2026-10-01 Fixed in 6.63.0 CWE-203
TI-2026-65646 CVE-2026-103271 · GHSA-2fr8-wvwh-rx7v

Ghost 4.0.0 before 6.63.0 Restricted Content Bypass

Priority MEDIUM 44

Ghost versions from 4.0.0 before 6.63.0 contain a content API vulnerability that allows unauthenticated visitors to access gated post content.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00379 Published 2026-10-01 Fixed in 6.63.0 CWE-863
TI-2021-10197 CVE-2021-29484 · GHSA-9fgx-q25h-jxrg

DOM XSS in Theme Preview

Priority MEDIUM 41

Ghost is a Node.js CMS.

CVSS 3.1MEDIUM 6.8 Network No auth User interaction EPSS 0.07935 Published 2021-04-29 Fixed in 4.3.3 CWE-79
TI-2026-66061 CVE-2026-104418 · GHSA-5pc5-4pc7-5x44

Ghost from 6.10.3 before 6.64.0 RCE via Theme Translation Files

Priority MEDIUM 40

Ghost from 6.10.3 before 6.64.0 contains a remote code execution vulnerability that allows authenticated administrators to run code by abusing theme translation file loading.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00654 Published 2026-10-02 Fixed in 6.64.0 CWE-22
TI-2026-65643 CVE-2026-103268 · GHSA-m47h-25hm-c3r9

Ghost 1.0.0 before 6.62.0 Suspension Bypass via Password Reset

Priority MEDIUM 40

Ghost versions before 6.62.0 contain an authentication bypass vulnerability that allows suspended staff users to reactivate their accounts through self-service password reset.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00317 Published 2026-10-01 Fixed in 6.62.0 CWE-862
Load more
Open these records in search →