Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: TryGhost Ghost 6.34.0 Clear all filters
TI-2026-65654 CVE-2026-103279 · GHSA-v827-452p-mh2j

Ghost 3.10.0 before 6.34.0 Session Invalidation Bypass

Priority LOW 34

Ghost versions from 3.10.0 before 6.34.0 fail to fully invalidate all sessions after a password change.

CVSS 4.0HIGH 7.6 Network Low privileges No interaction EPSS 0.00188 Published 2026-10-01 Fixed in 6.34.0 CWE-613
TI-2026-65653 CVE-2026-103278 · GHSA-72jh-g5rp-326j

Ghost 5.8.0 before 6.34.0 Staff Account Takeover via Admin iframe

Priority LOW 38

Ghost versions 5.8.0 before 6.34.0 contain an input validation vulnerability in the admin iframe that allows attackers to take over staff user accounts.

CVSS 4.0HIGH 8.5 Network Low privileges User interaction EPSS 0.00271 Published 2026-10-01 Fixed in 6.34.0 CWE-23
TI-2026-65652 CVE-2026-103277 · GHSA-h526-5mvq-49p7

Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed

Priority LOW 39

Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview feature that fails to sandbox externally hosted scripts.

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00273 Published 2026-10-01 Fixed in 6.34.0 CWE-79