Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: TryGhost Ghost 6.58.0 Clear all filters
TI-2026-65650 CVE-2026-103275 · GHSA-xqw5-w9qm-w396

Ghost 5.42.2 before 6.58.0 Password Hash Disclosure

Priority LOW 23

Ghost 5.42.2 before 6.58.0 contains an information disclosure vulnerability in the Admin API bulk post and page edit and delete endpoints, which accept filters on restricted fields such as authors.password, because of an…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0021 Published 2026-10-01 Fixed in 6.58.0 CWE-203
TI-2026-65649 CVE-2026-103274 · GHSA-w23p-63vq-8j33

Ghost 5.3.0 before 6.58.0 Unauthenticated Comment Read

Priority LOW 36

Ghost versions 5.3.0 before 6.58.0 fail to properly enforce access controls on comments in private mode.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00211 Published 2026-10-01 Fixed in 6.58.0 CWE-862
TI-2026-65648 CVE-2026-103273 · GHSA-3qxh-9f4j-4rwp

Ghost 4.3.0 before 6.58.0 Incorrect Authorization via Staff Token

Priority LOW 24

Ghost versions 4.3.0 before 6.58.0 contain an authentication bypass vulnerability where lower-privilege staff users can use staff tokens to bypass post editing restrictions.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00257 Published 2026-10-01 Fixed in 6.58.0 CWE-863