ghost vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-53949Mediumghost: Ghost Content API filter bypass reveals private fields CVE-2026-70596Mediumghost: Ghost: Cross-Site Scripting in Feature Image Captions CVE-2026-70595Mediumghost: Ghost: Server-Side Request Forgery Mitigation Issue CVE-2026-59817Mediumghost: Ghost: Paid gift memberships obtainable at minimal cost via the donations feature CVE-2026-53947Mediumghost: Ghost: Member existence leak via magic link sign-in response CVE-2026-70594Mediumghost: Ghost: Session Fixation in Ghost Admin CVE-2026-70593Mediumghost: Ghost: Theme Upload Path Traversal CVE-2026-70592Mediumghost: Ghost: Database Backup Path Traversal CVE-2026-70591Mediumghost: Ghost: Server-Side Request Forgery in Image Fetching CVE-2026-70590Mediumghost: Ghost: Blind Password Hash Disclosure in Ghost Admin API CVE-2026-53946Mediumghost: Ghost: Mobiledoc image-size fetch SSRF CVE-2026-53945Mediumghost: Ghost: Server-side request forgery via DNS rebinding in external request handling CVE-2026-53944Mediumghost: Ghost: Private IP filtering bypass to make server-side requests to internal services CVE-2026-70589Mediumghost: Ghost: Archived Offers can be Redeemed CVE-2026-53948Mediumghost: Ghost: File Upload Content-Type Spoofing CVE-2026-70588Mediumghost: Ghost: Cross-Site Scripting in Universal Import CVE-2026-53943Criticalghost: Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header CVE-2026-29784Highghost: Ghost has incomplete CSRF protections around OTC use CVE-2026-29053Highghost: Ghost Vulnerable to Remote Code Execution via Malicious Themes CVE-2026-26980Criticalghost: Ghost has a SQL injection in Content API CVE-2026-24778Highghost: Ghost vulnerable to XSS via malicious Portal preview links CVE-2026-22596Mediumghost: Ghost has SQL Injection in Members Activity Feed CVE-2026-22597Mediumghost: Ghost has SSRF via External Media Inliner CVE-2026-22595Highghost: Ghost has Staff Token permission bypass CVE-2026-22594Highghost: Ghost has Staff 2FA bypass

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo