Tryghost vulnerabilities
88 CVEs and advisories name Tryghost as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-63115ActivityPub Undo handler can unfollow or remove reposts on behalf of other accounts
- CVE-2026-105683Ghost: Path Traversal Vulnerability in Ghost ImageSize Service
- CVE-2026-105682Ghost: Server-Side Request Forgery in Webhook Trigger
- CVE-2026-105681Ghost: Authorization Bypass in Comments Feature
- CVE-2026-105680Ghost: Authorization Issue Allowed Author Role to Delete any Post
- CVE-2026-105679Ghost: Stored XSS via File Uploads on Local Storage
- CVE-2026-105678Ghost: Editors Could Promote Staff Users to Their Own Role
- CVE-2026-105677Ghost: Remote Code Execution via Theme Translation Files
- CVE-2026-105676Ghost: Path Traversal via Locale Setting
- CVE-2026-105675Ghost: Invite Token Disclosure in Ghost Admin API
- CVE-2026-105652Ghost: Password Hash Ordering Disclosure in Ghost Admin API
- CVE-2026-105651Ghost: Stored XSS via Bookmark Card Images
- CVE-2026-105650Ghost: Stored XSS via oEmbed Photo Responses
- CVE-2026-105649Ghost: Stored XSS via SVG Uploads Bypassing Sanitization
- CVE-2026-105648Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses
- CVE-2026-105647Ghost: Server-Side Request Forgery in Bookmark Fetching
- CVE-2026-105646Ghost: Regular Expression Denial of Service in Content Import
- CVE-2026-105645Ghost: Regular Expression Denial of Service in External Media Inliner
- CVE-2026-105644Ghost: Stored XSS via SVG Files in Content Imports
- CVE-2026-105643Ghost: Stored XSS via Embed Card Previews
- CVE-2026-105642Ghost: Remote Code Execution via Bookmark Card Images
- CVE-2026-104418Ghost from 6.10.3 before 6.64.0 RCE via Theme Translation Files
- CVE-2026-104417Ghost 1.20.0 before 6.64.0 Path Traversal via Locale Setting
- CVE-2026-104416Ghost 4.39.0 before 6.64.0 Invite Token Disclosure via Admin API
- CVE-2026-104415Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin API
- CVE-2026-104414Ghost from 2.5.0 before 6.64.0 Stored XSS via oEmbed Photo Responses
- CVE-2026-104413Ghost 5.94.0 before 6.64.0 Stored XSS via Bookmark Card Images
- CVE-2026-104412Ghost 0.5.0 before 6.64.0 Privilege Escalation via Staff Role Assignment
- CVE-2026-104411Ghost 6.22.1 before 6.64.0 Stored XSS via Local Storage File Uploads
- CVE-2026-103292Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_head