Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 104

Export CSV
CVE-2026-104416

Ghost 4.39.0 before 6.64.0 Invite Token Disclosure via Admin API

Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff users to view secret tokens of pending staff invites. Staff users with invite viewing permission can accept pending invites for higher-privileged roles to escalate their privileges.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Ghost
Products
Ghost
CVE-2026-104412

Ghost 0.5.0 before 6.64.0 Privilege Escalation via Staff Role Assignment

Ghost 0.5.0 before 6.64.0 does not correctly restrict staff role assignment, allowing users with the Editor or Super Editor role to assign their own role to other staff despite lacking permission to do so. An authenticated Editor or Super Editor can promote Author and Contributor users to Editor or Super Editor.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ghost
Products
Ghost
CVE-2026-103291

Ghost 3.20.2 before 6.51.0 SSRF via image-size fetch

Ghost versions from 3.20.2 before 6.51.0 contain a server-side request forgery vulnerability in image dimension refetching that allows authenticated staff users to trigger outbound HTTP requests to arbitrary URLs. Attackers can point image cards at attacker-controlled hosts or internal network endpoints to access metadata services and internal resources unavailable from the public internet.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ghost
Products
Ghost
CVE-2026-103287

Ghost 1.18.0 before 6.27.0 Server-Side Request Forgery via Webhook

Ghost versions 1.18.0 before 6.27.0 contain a server-side request forgery vulnerability in the webhooks feature that allows staff users to probe internal hosts. Attackers with staff privileges can craft webhook requests to access internal network resources from the Ghost server.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Ghost
Products
Ghost
CVE-2026-103283

Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling

Ghost versions 6.20.0 before 6.57.1 contain a session handling vulnerability that allows authenticated staff users to log in as any other staff user with only the password, bypassing two-factor authentication. Attackers with valid staff credentials can exploit improper session management to impersonate other staff members and gain unauthorized access to administrative functions.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Ghost
Products
Ghost
CVE-2026-103279

Ghost 3.10.0 before 6.34.0 Session Invalidation Bypass

Ghost versions from 3.10.0 before 6.34.0 fail to fully invalidate all sessions after a password change. Attackers with a stolen session cookie can maintain access to user accounts even after the associated user changes their password.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Ghost
Products
Ghost
CVE-2026-103275

Ghost 5.42.2 before 6.58.0 Password Hash Disclosure

Ghost 5.42.2 before 6.58.0 contains an information disclosure vulnerability in the Admin API bulk post and page edit and delete endpoints, which accept filters on restricted fields such as authors.password, because of an incomplete fix for CVE-2026-70590. Staff-level attackers can infer other staff users' password hashes from which filters match and perform offline password-guessing attacks against them.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ghost
Products
Ghost
CVE-2026-103271

Ghost 4.0.0 before 6.63.0 Restricted Content Bypass

Ghost versions from 4.0.0 before 6.63.0 contain a content API vulnerability that allows unauthenticated visitors to access gated post content. Attackers can bypass content restrictions by directly querying the content API to retrieve restricted posts without authentication.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Ghost
Products
Ghost
CVE-2026-103266

Ghost 5.2.0 before 6.62.0 Unauthenticated Stripe Checkout Account Modification

Ghost versions 5.2.0 through versions prior to 6.62.0 allow a remote attacker, without authentication, to abuse the Stripe Checkout flow to attach a paid subscription to an existing member, modify that member's name, and inject content into newsletters sent to the member. Depending on the recipient's email client, the injected content may be rendered, resulting in HTML injection or cross-site scripting (XSS).

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Ghost
Products
Ghost
CVE-2026-104414

Ghost from 2.5.0 before 6.64.0 Stored XSS via oEmbed Photo Responses

Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untrusted scripts into post content via oEmbed photo responses. Attackers can host malicious oEmbed photo responses so that embedding their URL stores scripts that run in the Ghost editor, published site, and newsletter emails, compromising staff admin sessions.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Ghost
Products
Ghost
CVE-2026-104418

Ghost from 6.10.3 before 6.64.0 RCE via Theme Translation Files

Ghost from 6.10.3 before 6.64.0 contains a remote code execution vulnerability that allows authenticated administrators to run code by abusing theme translation file loading. Attackers with administrator access can upload a crafted theme containing malicious translation files to execute arbitrary code on the Ghost server.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Ghost
Products
Ghost
CVE-2026-104411

Ghost 6.22.1 before 6.64.0 Stored XSS via Local Storage File Uploads

Ghost from 6.22.1 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users to host scripts by uploading files served with extension-derived content types on the default local storage adapter. Attackers can upload script-bearing files to the site's domain to compromise other staff users' admin sessions.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Ghost
Products
Ghost
CVE-2026-104417

Ghost 1.20.0 before 6.64.0 Path Traversal via Locale Setting

Ghost from 1.20.0 before 6.64.0 contains a path traversal vulnerability in theme translation file loading that allows authenticated administrators to read JSON files outside the active theme directory. Attackers can manipulate the locale setting to load JSON files elsewhere on the server, exposing server configuration secrets.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Ghost
Products
Ghost
CVE-2026-104415

Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin API

Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level users to determine the relative ordering of other staff users' password hashes. Authenticated staff users can query the Admin API to infer hash ordering, though this does not directly reveal hashes or enable practical password recovery.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Ghost
Products
Ghost
CVE-2026-104413

Ghost 5.94.0 before 6.64.0 Stored XSS via Bookmark Card Images

Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host arbitrary HTML by abusing bookmark card image fetching. Attackers can create bookmark cards that store non-image files from external websites as icons or thumbnails to compromise other staff users' admin sessions.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Ghost
Products
Ghost
CVE-2026-103281

Ghost 3.23.0 before 6.23.0 API Key Exposure via Admin API

Ghost (npm package 'ghost') versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-privilege staff accounts. An authenticated low-privilege staff user can read API keys returned by the Admin API, which are intended to be available only to higher-privileged users.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ghost
Products
Ghost
CVE-2026-103285

Ghost 5.19.0 before 6.57.1 Cross-Site Request Forgery

Ghost versions from 5.19.0 before 6.57.1 contain a cross-site request forgery vulnerability in the post feedback functionality that allows attackers to submit feedback on behalf of logged-in users. Attackers can craft a malicious link to the feedback page that automatically submits feedback when visited by authenticated members without their knowledge or consent.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ghost
Products
Ghost
CVE-2026-103272

Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content API

Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauthenticated attackers to leak user data. Attackers can observe discrepancies in API metadata responses to enumerate staff members and extract sensitive information without authentication.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Ghost
Products
Ghost
CVE-2026-103267

Ghost 0.5.0 before 6.62.0 Arbitrary Email Registration via Staff Invite

Ghost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users to specify any email address when creating their account. Attackers can accept leaked invite tokens with attacker-controlled email addresses, or legitimate recipients can register with unintended email providers.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ghost
Products
Ghost
CVE-2026-103286

Ghost 2.21.0 before 6.56.0 Privilege Escalation via Notifications

Ghost versions from 2.21.0 before 6.56.0 contain a privilege escalation vulnerability in the notifications system that allows low-privilege staff users to escalate to higher-privilege staff roles. Attackers with low-privilege staff access can exploit the notifications system to gain elevated privileges without proper authorization checks.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Ghost
Products
Ghost