Skip to content
OpenAdvisories

Vendor

TryGhost

88 known vulnerabilities.

Products

Ghost 85 express-hbs 1 Ghost-CLI 1 ActivityPub 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.6
    CVE-2026-53943

    Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header

    Ghost is a Node.js content management system. From until 6.37.0, when Ghost is behind a shared caching layer that results in cached content being shared between different visitors, an unauthenticated user could send an x-ghost-preview header that altered the …

    TryGhost Ghost ghost npm
  • Critical 9.4
    CVE-2026-26980 Public exploit EPSS 71%

    Ghost has a SQL Injection in its Content API

    Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.

    TryGhost Ghost ghost npm