ghost

5 results · Clear filters · Feed

• Critical 9.6
  CVE-2026-53943

  Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header

  Ghost is a Node.js content management system. From until 6.37.0, when Ghost is behind a shared caching layer that results in cached content being shared between different visitors, an unauthenticated user could send an x-ghost-preview header that altered the …

  TryGhost Ghost ghost npm
  Jun 24, 2026
• Critical 9.4
  CVE-2026-26980 Public exploit Scanner template EPSS 71%

  Ghost has a SQL Injection in its Content API

  Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.

  TryGhost Ghost ghost npm
  Feb 20, 2026
• Critical 9.6
  CVE-2022-41654 EPSS 19%

  ghost vulnerable to unauthorized newsletter modification via improper access controls

  An authentication bypass vulnerability exists in the newsletter subscription functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted HTTP request can lead to increased privileges. An attacker can send an HTTP request to trigger this vulnerability.

  Ghost Foundation Ghost ghost npm
  Dec 23, 2022
• Critical 9.8
  CVE-2022-28397

  Arbitrary file upload in Ghost

  An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a crafted file. NOTE: Vendor states as detailed in Ghost's security documentation, files can only be uploaded and published by…

  ghost npm
  Apr 12, 2022
• Critical 9.8
  CVE-2022-27139

  Arbitrary file upload in Ghost

  An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows attackers to execute arbitrary code via a crafted SVG file. NOTE: Vendor states that as outlined in Ghost's security documentation, upload of SVGs is only possible by tru…

  ghost npm
  Apr 12, 2022