ghost vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-53943Criticalghost: Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header CVE-2026-29784Highghost: Ghost has incomplete CSRF protections around OTC use CVE-2026-29053Highghost: Ghost Vulnerable to Remote Code Execution via Malicious Themes CVE-2026-26980Criticalghost: Ghost has a SQL injection in Content API CVE-2026-24778Highghost: Ghost vulnerable to XSS via malicious Portal preview links CVE-2026-22596Mediumghost: Ghost has SQL Injection in Members Activity Feed CVE-2026-22597Mediumghost: Ghost has SSRF via External Media Inliner CVE-2026-22595Highghost: Ghost has Staff Token permission bypass CVE-2026-22594Highghost: Ghost has Staff 2FA bypass CVE-2025-9862Mediumghost: Ghost vulnerable to Server Side Request Forgery (SSRF) via oEmbed Bookmark CVE-2024-43409Mediumghost: Ghost's improper authentication allows access to member information and actions CVE-2024-23724Mediumghost: Ghost has possible Cross-site Scripting issue CVE-2024-23725Mediumghost: Cross-site Scripting in Ghost CVE-2023-40028Mediumghost: Ghost vulnerable to arbitrary file read via symlinks in content import CVE-2023-32235Highghost: Path Traversal in Ghost CVE-2023-31133Highghost: Ghost vulnerable to information disclosure of private API fields CVE-2022-41654Highghost: ghost vulnerable to unauthorized newsletter modification via improper access controls GHSA-7V28-G2PQ-GGG8Mediumghost: Ghost vulnerable to remote code execution in locale setting change CVE-2022-27139Criticalghost: Arbitrary file upload in Ghost CVE-2022-28397Criticalghost: Arbitrary file upload in Ghost GHSA-65P7-PJJ8-GGMRMediumghost: Member account takeover GHSA-WFRJ-QQC2-83CMMediumghost: Remote command injection when using sendmail email transport CVE-2021-39192Mediumghost: Privilege escalation: all users can access Admin-level API keys CVE-2020-8134Mediumghost: Server-side request forgery in Ghost CMS CVE-2021-29484Mediumghost: DOM XSS in Theme Preview

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo