InfoSec Signals™
Sign InStart Free

CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,479 CVEs published, 360 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

Published in the last 7 days
5,479
Show in the list
Critical, last 7 days
360
Show in the list
Healthcare-tagged, last 7 days
5
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list
Clear

Showing CVEs that name the product tryghost:ghost. Show all products

63 CVEs, showing 1 to 50Page 1 of 2Next
CVESeverityTitlePublished
CVE-2026-70588Medium 5.0Ghost: Cross-Site Scripting in Universal Import
Assigned by GitHub_M
Aug 4, 2026
CVE-2026-70589Medium 4.8Ghost: Archived Offers can be Redeemed
Assigned by GitHub_M
Aug 4, 2026
CVE-2026-70590Medium 4.8Ghost: Blind Password Hash Disclosure in Ghost Admin API
Assigned by GitHub_M
Aug 4, 2026
CVE-2026-70591Medium 4.1Ghost: Server-Side Request Forgery in Image Fetching
Assigned by GitHub_M
Aug 4, 2026
CVE-2026-70592Medium 5.5Ghost: Database Backup Path Traversal
Assigned by GitHub_M
Aug 4, 2026
CVE-2026-70593Medium 6.6Ghost: Theme Upload Path Traversal
Assigned by GitHub_M
Aug 4, 2026
CVE-2026-70594Medium 6.7Ghost: Session Fixation in Ghost Admin
Assigned by GitHub_M
Aug 4, 2026
CVE-2026-70595Medium 4.0Ghost: Server-Side Request Forgery Mitigation Issue
Assigned by GitHub_M
Aug 5, 2026
CVE-2026-70596Medium 4.3Ghost: Cross-Site Scripting in Feature Image Captions
Assigned by GitHub_M
Aug 5, 2026
CVE-2026-103266High 7.1Ghost 5.2.0 before 6.62.0 Unauthenticated Stripe Checkout Account Modification
Assigned by VulnCheck
Oct 1, 2026
CVE-2026-103267Medium 4.3Ghost 0.5.0 before 6.62.0 Arbitrary Email Registration via Staff Invite
Assigned by VulnCheck
Oct 1, 2026
CVE-2026-103268High 8.8Ghost 1.0.0 before 6.62.0 Suspension Bypass via Password Reset
Assigned by VulnCheck
Oct 1, 2026
CVE-2026-103269Medium 5.3Ghost 5.3.0 before 6.62.0 Missing Authorization via Post Excerpts
Assigned by VulnCheck
Oct 1, 2026
CVE-2026-103271High 7.5Ghost 4.0.0 before 6.63.0 Restricted Content Bypass
Assigned by VulnCheck
Oct 1, 2026
CVE-2026-103272High 7.5Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content API
Assigned by VulnCheck
Oct 1, 2026
CVE-2026-103273Medium 4.3Ghost 4.3.0 before 6.58.0 Incorrect Authorization via Staff Token
Assigned by VulnCheck
Oct 1, 2026
CVE-2026-103274Medium 5.3Ghost 5.3.0 before 6.58.0 Unauthenticated Comment Read
Assigned by VulnCheck
Oct 1, 2026
CVE-2026-103275Medium 4.3Ghost 5.42.2 before 6.58.0 Password Hash Disclosure
Assigned by VulnCheck
Oct 1, 2026
CVE-2026-103276Medium 5.3Ghost before 6.20.0 File Read via URL Encoding Bypass
Assigned by VulnCheck
Oct 1, 2026
CVE-2026-103277High 8.1Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed
Assigned by VulnCheck
Oct 1, 2026
CVE-2026-103278High 7.3Ghost 5.8.0 before 6.34.0 Staff Account Takeover via Admin iframe
Assigned by VulnCheck
Oct 1, 2026
CVE-2026-103279Medium 6.8Ghost 3.10.0 before 6.34.0 Session Invalidation Bypass
Assigned by VulnCheck
Oct 1, 2026
CVE-2026-103280Medium 5.3Ghost 0.8.0 before 6.23.0 Information Disclosure via Setup Endpoint
Assigned by VulnCheck
Oct 1, 2026
CVE-2026-103281Medium 5.4Ghost 3.23.0 before 6.23.0 API Key Exposure via Admin API
Assigned by VulnCheck
Oct 1, 2026
CVE-2026-103282Medium 4.3Ghost 0.5.0 before 6.23.0 Multiple Account Creation via Invite Token
Assigned by VulnCheck
Oct 1, 2026
CVE-2026-103283High 8.1Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling
Assigned by VulnCheck
Oct 1, 2026
CVE-2026-103284Medium 4.3Ghost 5.125.1 before 6.57.1 Information Disclosure via Feedback
Assigned by VulnCheck
Oct 1, 2026
CVE-2026-103285Medium 4.3Ghost 5.19.0 before 6.57.1 Cross-Site Request Forgery
Assigned by VulnCheck
Oct 1, 2026
CVE-2026-103286High 7.3Ghost 2.21.0 before 6.56.0 Privilege Escalation via Notifications
Assigned by VulnCheck
Oct 1, 2026
CVE-2026-103287Low 2.7Ghost 1.18.0 before 6.27.0 Server-Side Request Forgery via Webhook
Assigned by VulnCheck
Oct 1, 2026
CVE-2026-103288Medium 6.5Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like
Assigned by VulnCheck
Oct 1, 2026
CVE-2026-103289Medium 6.5Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments
Assigned by VulnCheck
Oct 1, 2026
CVE-2026-103290Low 3.8Ghost 6.14.0 before 6.27.0 Path Traversal via ImageSize
Assigned by VulnCheck
Oct 1, 2026
CVE-2026-103291Medium 6.4Ghost 3.20.2 before 6.51.0 SSRF via image-size fetch
Assigned by VulnCheck
Oct 1, 2026
CVE-2026-103292High 8.0Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_head
Assigned by VulnCheck
Oct 1, 2026
CVE-2026-104411High 7.3Ghost 6.22.1 before 6.64.0 Stored XSS via Local Storage File Uploads
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104412Medium 4.3Ghost 0.5.0 before 6.64.0 Privilege Escalation via Staff Role Assignment
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104413High 7.3Ghost 5.94.0 before 6.64.0 Stored XSS via Bookmark Card Images
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104414High 8.1Ghost from 2.5.0 before 6.64.0 Stored XSS via oEmbed Photo Responses
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104415Low 3.1Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin API
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104416High 7.5Ghost 4.39.0 before 6.64.0 Invite Token Disclosure via Admin API
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104417Medium 4.9Ghost 1.20.0 before 6.64.0 Path Traversal via Locale Setting
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-104418High 7.2Ghost from 6.10.3 before 6.64.0 RCE via Theme Translation Files
Assigned by VulnCheck
Oct 2, 2026
CVE-2026-105642High 8.8Ghost: Remote Code Execution via Bookmark Card Images
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-105643High 7.3Ghost: Stored XSS via Embed Card Previews
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-105644Medium 6.8Ghost: Stored XSS via SVG Files in Content Imports
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-105645Medium 4.9Ghost: Regular Expression Denial of Service in External Media Inliner
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-105646Medium 4.9Ghost: Regular Expression Denial of Service in Content Import
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-105647Medium 4.0Ghost: Server-Side Request Forgery in Bookmark Fetching
Assigned by GitHub_M
Oct 5, 2026
CVE-2026-105648Medium 4.0Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses
Assigned by GitHub_M
Oct 5, 2026
Page 1 of 2Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.