Read the docs

TryGhost

Records110All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical8CVSS 9.0–10.0
CVSS high39CVSS 7.0–8.9

Exploited now

TryGhost records in CISA KEV

No TryGhost vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Ghost 30 records CRITICAL Sqlite3 3 records MEDIUM Portal 1 record MEDIUM

Records

30 records in Ghost · all components

TI-2026-21459 CVE-2026-26980 · GHSA-w52v-v783-gw97

Ghost has a SQL Injection in its Content API

Priority CRITICAL 86

Ghost is a Node.js content management system.

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.71095 Published 2026-02-20 Fixed in 6.19.1 CWE-89
TI-2023-14843 CVE-2023-31133 · GHSA-r97q-ghch-82j9

Ghost vulnerable to disclosure of private API fields

Priority HIGH 68

Ghost is an app for new-media creators with tools to build a website, publish content, send newsletters, and offer paid subscriptions to members.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.45713 Published 2023-05-08 Fixed in 5.46.1 CWE-200
TI-2025-09049 CVE-2025-9862 · GHSA-f7qg-xj45-w956

Ghost 6.0.6 - SSRF via oEmbed Bookmark

Priority HIGH 66

Server-Side Request Forgery (SSRF) vulnerability in Ghost allows an attacker to access internal resources.This issue affects Ghost: from 6.0.0 through 6.0.8, from 5.99.0 through 5.130.3.

CVSS 4.0MEDIUM 6.1 Network High privileges No interaction EPSS 0.00517 Published 2025-09-17 Fixed in 6.0.9, 5.130.4 CWE-918
TI-2023-20918 CVE-2023-40028 · GHSA-9c9v-w225-v5rg

Arbitrary file read via symlinks in Ghost

Priority HIGH 66

Ghost is an open source content management system.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.68954 Published 2023-08-15 Fixed in 5.59.1 CWE-22
TI-2022-23399 CVE-2022-47196 · GHSA-vx4r-h2xh-2c27

Cross-site scripting in TryGhost Ghost

Priority MEDIUM 60

An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0069 Published 2023-01-19 No fix listed CWE-453
TI-2022-23398 CVE-2022-47195 · GHSA-g78m-xpj3-3hwr

Cross-site scripting in TryGhost Ghost

Priority MEDIUM 60

An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0069 Published 2023-01-19 No fix listed CWE-453
TI-2022-23397 CVE-2022-47194 · GHSA-gfr8-qfh4-r5rc

Cross-site scripting in TryGhost Ghost

Priority MEDIUM 60

An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00824 Published 2023-01-19 No fix listed CWE-453
TI-2022-20049 CVE-2022-41654 · GHSA-9gh8-wp53-ccc6

Improper access control in TryGhost Ghost

Priority MEDIUM 55

An authentication bypass vulnerability exists in the newsletter subscription functionality of Ghost Foundation Ghost 5.9.4.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.18914 Published 2022-12-23 Fixed in 5.22.7, 4.48.8 CWE-284
TI-2024-15729 CVE-2024-23724 · GHSA-99vc-xw8j-phjm

Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a…

Priority MEDIUM 47

Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost…

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.03485 Published 2024-02-11 No fix listed CWE-79
TI-2021-10197 CVE-2021-29484 · GHSA-9fgx-q25h-jxrg

DOM XSS in Theme Preview

Priority MEDIUM 41

Ghost is a Node.js CMS.

CVSS 3.1MEDIUM 6.8 Network No auth User interaction EPSS 0.07935 Published 2021-04-29 Fixed in 4.3.3 CWE-79
TI-2026-18155 CVE-2026-22594 · GHSA-5fp7-g646-ccf4

Ghost has Staff 2FA bypass

Priority MEDIUM 40

Ghost is a Node.js content management system.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.01315 Published 2026-01-10 Fixed in 6.11.0, 5.130.6 CWE-287
TI-2026-18156 CVE-2026-22595 · GHSA-9xg7-mwmp-xmjx

Ghost has Staff Token permission bypass

Priority LOW 38

Ghost is a Node.js content management system.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00537 Published 2026-01-10 Fixed in 6.11.0, 5.130.6 CWE-863
TI-2020-06552 CVE-2020-8134 · GHSA-q4h8-7qff-gh6c

Server-side request forgery in Ghost

Priority LOW 38

Server-side request forgery (SSRF) vulnerability in Ghost CMS < 3.10.0 allows an attacker to scan local or external network or otherwise interact with internal systems.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0122 Published 2020-03-20 Fixed in 3.10.0 CWE-918
Load more
Open these records in search →