TryGhost vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-105679 Ghost is a Node.js content management system.High 7.3 · Oct 5, 2026
• CVE-2026-105677 Ghost is a Node.js content management system.High 7.2 · Oct 5, 2026
• CVE-2026-105675 Ghost is a Node.js content management system.High 7.5 · Oct 5, 2026
• CVE-2026-105651 Ghost is a Node.js content management system.High 7.3 · Oct 5, 2026
• CVE-2026-105650 Ghost is a Node.js content management system.High 8.1 · Oct 5, 2026
• CVE-2026-105649 Ghost is a Node.js content management system.High 7.3 · Oct 5, 2026
• CVE-2026-105643 Ghost is a Node.js content management system.High 7.3 · Oct 5, 2026
• CVE-2026-105642 Ghost is a Node.js content management system.High 8.8 · Oct 5, 2026
• CVE-2026-104418 Ghost from 6.10.3 before 6.64.0 contains a remote code execution vulnerability that allows authenticated administrators to run code by abusing theme translationHigh 8.6 · Oct 2, 2026
• CVE-2026-104416 Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff users to view secret tokens of pending staffHigh 7.7 · Oct 2, 2026
• CVE-2026-104414 Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untrusted scripts into post content via oEmbHigh 8.6 · Oct 2, 2026
• CVE-2026-104413 Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host arbitrary HTML by High 8.5 · Oct 2, 2026
• CVE-2026-104411 Ghost from 6.22.1 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users to host scripts by uploading files served with exteHigh 8.5 · Oct 2, 2026
• CVE-2026-103292 Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emitted by the {{ghost_head}} helper.High 8.6 · Oct 1, 2026
• CVE-2026-103289 Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access comments they are not authHigh 7.1 · Oct 1, 2026
• CVE-2026-103288 Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1.High 7.1 · Oct 1, 2026
• CVE-2026-103286 Ghost versions from 2.21.0 before 6.56.0 contain a privilege escalation vulnerability in the notifications system that allows low-privilege staff users to escalHigh 8.5 · Oct 1, 2026
• CVE-2026-103283 Ghost versions 6.20.0 before 6.57.1 contain a session handling vulnerability that allows authenticated staff users to log in as any other staff user with only tHigh 8.6 · Oct 1, 2026
• CVE-2026-103279 Ghost versions from 3.10.0 before 6.34.0 fail to fully invalidate all sessions after a password change.High 7.6 · Oct 1, 2026
• CVE-2026-103278 Ghost versions 5.8.0 before 6.34.0 contain an input validation vulnerability in the admin iframe that allows attackers to take over staff user accounts.High 8.5 · Oct 1, 2026
• CVE-2026-103277 Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview feature that fails to sandbox externally hosteHigh 8.6 · Oct 1, 2026
• CVE-2026-103272 Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauthenticated attackers to leak user data.High 8.7 · Oct 1, 2026
• CVE-2026-103271 Ghost versions from 4.0.0 before 6.63.0 contain a content API vulnerability that allows unauthenticated visitors to access gated post content.High 8.7 · Oct 1, 2026
• CVE-2026-103268 Ghost versions before 6.62.0 contain an authentication bypass vulnerability that allows suspended staff users to reactivate their accounts through self-service High 8.7 · Oct 1, 2026
• CVE-2026-103266 Ghost versions 5.2.0 through versions prior to 6.62.0 allow a remote attacker, without authentication, to abuse the Stripe Checkout flow to attach a paid subscrHigh 7.1 · Oct 1, 2026