Skip to content
OpenAdvisories

Vendor

TryGhost

88 known vulnerabilities.

Products

Ghost 85 express-hbs 1 Ghost-CLI 1 ActivityPub 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.4
    CVE-2026-26980 Public exploit EPSS 71%

    Ghost has a SQL Injection in its Content API

    Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.

    TryGhost Ghost ghost npm