Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

30 records

Vendor: TryGhost Component: Ghost Clear all filters
TI-2026-21459 CVE-2026-26980 · GHSA-w52v-v783-gw97

Ghost has a SQL Injection in its Content API

Priority CRITICAL 86

Ghost is a Node.js content management system.

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.71095 Published 2026-02-20 Fixed in 6.19.1 CWE-89
TI-2026-18158 CVE-2026-22597 · GHSA-vmc4-9828-r48r

Ghost has SSRF via External Media Inliner

Priority LOW 23

Ghost is a Node.js content management system.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00297 Published 2026-01-10 Fixed in 6.11.0, 5.130.6 CWE-918
TI-2026-18156 CVE-2026-22595 · GHSA-9xg7-mwmp-xmjx

Ghost has Staff Token permission bypass

Priority LOW 38

Ghost is a Node.js content management system.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00537 Published 2026-01-10 Fixed in 6.11.0, 5.130.6 CWE-863
TI-2026-18155 CVE-2026-22594 · GHSA-5fp7-g646-ccf4

Ghost has Staff 2FA bypass

Priority MEDIUM 40

Ghost is a Node.js content management system.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.01315 Published 2026-01-10 Fixed in 6.11.0, 5.130.6 CWE-287
TI-2025-09049 CVE-2025-9862 · GHSA-f7qg-xj45-w956

Ghost 6.0.6 - SSRF via oEmbed Bookmark

Priority HIGH 66

Server-Side Request Forgery (SSRF) vulnerability in Ghost allows an attacker to access internal resources.This issue affects Ghost: from 6.0.0 through 6.0.8, from 5.99.0 through 5.130.3.

CVSS 4.0MEDIUM 6.1 Network High privileges No interaction EPSS 0.00517 Published 2025-09-17 Fixed in 6.0.9, 5.130.4 CWE-918
TI-2024-15729 CVE-2024-23724 · GHSA-99vc-xw8j-phjm

Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a…

Priority MEDIUM 47

Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost…

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.03485 Published 2024-02-11 No fix listed CWE-79
TI-2023-20918 CVE-2023-40028 · GHSA-9c9v-w225-v5rg

Arbitrary file read via symlinks in Ghost

Priority HIGH 66

Ghost is an open source content management system.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.68954 Published 2023-08-15 Fixed in 5.59.1 CWE-22
TI-2023-14843 CVE-2023-31133 · GHSA-r97q-ghch-82j9

Ghost vulnerable to disclosure of private API fields

Priority HIGH 68

Ghost is an app for new-media creators with tools to build a website, publish content, send newsletters, and offer paid subscriptions to members.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.45713 Published 2023-05-08 Fixed in 5.46.1 CWE-200
TI-2023-11647 CVE-2023-26510 · GHSA-wx96-h8xj-9x6g

Ghost 5.35.0 allows authorization bypass: contributors can view draft posts of other…

Priority LOW 27

Ghost 5.35.0 allows authorization bypass: contributors can view draft posts of other users, which is arguably inconsistent with a security policy in which a contributor's draft can only be read by editors until published…

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.0063 Published 2023-03-05 No fix listed CWE-862
TI-2022-23400 CVE-2022-47197 · GHSA-vw7m-649j-qh5x

Cross-site scripting in TryGhost Ghost

Priority LOW 28

An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01025 Published 2023-01-19 No fix listed CWE-453
TI-2022-23399 CVE-2022-47196 · GHSA-vx4r-h2xh-2c27

Cross-site scripting in TryGhost Ghost

Priority MEDIUM 60

An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0069 Published 2023-01-19 No fix listed CWE-453
TI-2022-23398 CVE-2022-47195 · GHSA-g78m-xpj3-3hwr

Cross-site scripting in TryGhost Ghost

Priority MEDIUM 60

An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0069 Published 2023-01-19 No fix listed CWE-453
TI-2022-23397 CVE-2022-47194 · GHSA-gfr8-qfh4-r5rc

Cross-site scripting in TryGhost Ghost

Priority MEDIUM 60

An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00824 Published 2023-01-19 No fix listed CWE-453
TI-2022-20049 CVE-2022-41654 · GHSA-9gh8-wp53-ccc6

Improper access control in TryGhost Ghost

Priority MEDIUM 55

An authentication bypass vulnerability exists in the newsletter subscription functionality of Ghost Foundation Ghost 5.9.4.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.18914 Published 2022-12-23 Fixed in 5.22.7, 4.48.8 CWE-284
Load more