Tryghost Ghost
31 CVEs affecting Tryghost Ghost. Latest disclosed: 2026-08-05. Critical: 2, High: 7.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-53943 | Critical | 9.6 | 2026-06-24 | Ghost is a Node.js content management system. From until 6.37.0, when Ghost is behind a shared caching layer that results in cached content being shared betwe… |
CVE-2026-26980 | Critical | 9.4 | 2026-02-20 | Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This… |
CVE-2026-24778 | High | 8.8 | 2026-01-27 | Ghost is an open source content management system. In Ghost versions 5.43.0 through 5.12.04 and 6.0.0 through 6.14.0, an attacker was able to craft a malicious… |
CVE-2026-22595 | High | 8.1 | 2026-01-10 | Ghost is a Node.js content management system. In versions 5.121.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's handling of Staff Token… |
CVE-2026-22594 | High | 8.1 | 2026-01-10 | Ghost is a Node.js content management system. In versions 5.105.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's 2FA mechanism allows sta… |
CVE-2026-29053 | High | 7.6 | 2026-03-05 | Ghost is a Node.js content management system. From version 0.7.2 to 6.19.0, specifically crafted malicious themes can execute arbitrary code on the server runn… |
CVE-2026-53950 | High | 7.5 | 2026-06-24 | @tryghost/activitypub is Ghost’s social/federation client app. Prior to 3.1.0, the ActivityPub client in Ghost was vulnerable to JavaScript injection on posts… |
CVE-2026-29784 | High | 7.5 | 2026-03-07 | Ghost is a Node.js content management system. From version 5.101.6 to 6.19.2, incomplete CSRF protections around /session/verify made it possible to use OTCs i… |
CVE-2023-31133 | High | 7.5 | 2023-05-08 | Ghost is an app for new-media creators with tools to build a website, publish content, send newsletters, and offer paid subscriptions to members. Prior to vers… |
CVE-2021-29484 | Medium | 6.8 | 2021-04-29 | Ghost is a Node.js CMS. An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access to Ghost Admin. At… |
CVE-2026-70594 | Medium | 6.7 | 2026-08-04 | Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost Admin did not invalidate existing sessions on login which could have allowed for s… |
CVE-2026-22596 | Medium | 6.7 | 2026-01-10 | Ghost is a Node.js content management system. In versions 5.90.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's /ghost/api/admin/members/… |
CVE-2026-70593 | Medium | 6.6 | 2026-08-04 | Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a vulnerability in custom themes allowed a staff user to write files outside of the upl… |
CVE-2024-43409 | Medium | 6.5 | 2024-08-20 | Ghost is a Node.js content management system. Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only… |
CVE-2021-39192 | Medium | 6.5 | 2021-09-03 | Ghost is a Node.js content management system. An error in the implementation of the limits service between versions 4.0.0 and 4.9.4 allows all authenticated us… |
CVE-2026-53944 | Medium | 5.8 | 2026-06-24 | Ghost is a Node.js content management system. From 6.0.9 until 6.21.1, when making an external request, it is possible to bypass the IP filter that ensures the… |
CVE-2026-70592 | Medium | 5.5 | 2026-08-04 | Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem th… |
CVE-2026-53948 | Medium | 5.4 | 2026-06-24 | Ghost is a Node.js content management system. From 6.19.4 until 6.21.1, insufficient validation of the client-supplied Content-Type on Ghost's Admin API file u… |
CVE-2026-53946 | Medium | 5.4 | 2026-06-24 | Ghost is a Node.js content management system. From 6.19.4 until 6.21.1, when re-rendering posts, Ghost would refetch missing image dimensions by issuing an out… |
CVE-2026-59817 | Medium | 5.3 | 2026-07-09 | Ghost is a Node.js content management system. From 6.27.0 before 6.44.0, Ghost's public donation checkout flow allowed an unauthenticated attacker to control d… |