Tryghost Ghost
85 CVEs affecting Tryghost Ghost. Latest disclosed: 2026-10-05. Critical: 2, High: 29.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-53943 | Critical | 9.6 | 2026-06-24 | Ghost is a Node.js content management system. From until 6.37.0, when Ghost is behind a shared caching layer that results in cached content being shared betwe… |
CVE-2026-26980 | Critical | 9.4 | 2026-02-20 | Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This… |
CVE-2026-105642 | High | 8.8 | 2026-10-05 | Ghost is a Node.js content management system. From 6.56.0 until 6.67.0, an image processing library bundled with Ghost contained a vulnerability in its SVG han… |
CVE-2026-103268 | High | 8.8 | 2026-10-01 | Ghost versions before 6.62.0 contain an authentication bypass vulnerability that allows suspended staff users to reactivate their accounts through self-service… |
CVE-2026-24778 | High | 8.8 | 2026-01-27 | Ghost is an open source content management system. In Ghost versions 5.43.0 through 5.12.04 and 6.0.0 through 6.14.0, an attacker was able to craft a malicious… |
CVE-2026-105650 | High | 8.1 | 2026-10-05 | Ghost is a Node.js content management system. From 2.1.0 until 6.64.0, embedding a URL from an attacker-controlled website could result in untrusted scripts be… |
CVE-2026-104414 | High | 8.1 | 2026-10-02 | Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untrusted scripts into post content via oEm… |
CVE-2026-103283 | High | 8.1 | 2026-10-01 | Ghost versions 6.20.0 before 6.57.1 contain a session handling vulnerability that allows authenticated staff users to log in as any other staff user with only… |
CVE-2026-103277 | High | 8.1 | 2026-10-01 | Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview feature that fails to sandbox externally host… |
CVE-2026-22595 | High | 8.1 | 2026-01-10 | Ghost is a Node.js content management system. In versions 5.121.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's handling of Staff Token… |
CVE-2026-22594 | High | 8.1 | 2026-01-10 | Ghost is a Node.js content management system. In versions 5.105.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's 2FA mechanism allows sta… |
CVE-2026-103292 | High | 8.0 | 2026-10-01 | Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emitted by the {{ghost_head}} helper. An au… |
CVE-2026-29053 | High | 7.6 | 2026-03-05 | Ghost is a Node.js content management system. From version 0.7.2 to 6.19.0, specifically crafted malicious themes can execute arbitrary code on the server runn… |
CVE-2026-105675 | High | 7.5 | 2026-10-05 | Ghost is a Node.js content management system. From 4.39.0 until 6.64.0, staff users with permission to view staff invites were able to discover the secret toke… |
CVE-2026-104416 | High | 7.5 | 2026-10-02 | Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff users to view secret tokens of pending staf… |
CVE-2026-103272 | High | 7.5 | 2026-10-01 | Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauthenticated attackers to leak user data… |
CVE-2026-103271 | High | 7.5 | 2026-10-01 | Ghost versions from 4.0.0 before 6.63.0 contain a content API vulnerability that allows unauthenticated visitors to access gated post content. Attackers can by… |
CVE-2026-53950 | High | 7.5 | 2026-06-24 | @tryghost/activitypub is Ghost’s social/federation client app. Prior to 3.1.0, the ActivityPub client in Ghost was vulnerable to JavaScript injection on posts… |
CVE-2026-29784 | High | 7.5 | 2026-03-07 | Ghost is a Node.js content management system. From version 5.101.6 to 6.19.2, incomplete CSRF protections around /session/verify made it possible to use OTCs i… |
CVE-2023-31133 | High | 7.5 | 2023-05-08 | Ghost is an app for new-media creators with tools to build a website, publish content, send newsletters, and offer paid subscriptions to members. Prior to vers… |