# cve.now: Tryghost

The newest entries naming Tryghost as an affected vendor (up to 200), of 88 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-63115](https://cve.now/CVE-2026-63115.md): ActivityPub Undo handler can unfollow or remove reposts on behalf of other accounts (CVSS 5.3)
- [CVE-2026-105683](https://cve.now/CVE-2026-105683.md): Ghost: Path Traversal Vulnerability in Ghost ImageSize Service (CVSS 3.8)
- [CVE-2026-105682](https://cve.now/CVE-2026-105682.md): Ghost: Server-Side Request Forgery in Webhook Trigger (CVSS 2.7)
- [CVE-2026-105681](https://cve.now/CVE-2026-105681.md): Ghost: Authorization Bypass in Comments Feature (CVSS 6.5)
- [CVE-2026-105680](https://cve.now/CVE-2026-105680.md): Ghost: Authorization Issue Allowed Author Role to Delete any Post (CVSS 6.5)
- [CVE-2026-105679](https://cve.now/CVE-2026-105679.md): Ghost: Stored XSS via File Uploads on Local Storage (CVSS 7.3)
- [CVE-2026-105678](https://cve.now/CVE-2026-105678.md): Ghost: Editors Could Promote Staff Users to Their Own Role (CVSS 4.3)
- [CVE-2026-105677](https://cve.now/CVE-2026-105677.md): Ghost: Remote Code Execution via Theme Translation Files (CVSS 7.2)
- [CVE-2026-105676](https://cve.now/CVE-2026-105676.md): Ghost: Path Traversal via Locale Setting (CVSS 4.9)
- [CVE-2026-105675](https://cve.now/CVE-2026-105675.md): Ghost: Invite Token Disclosure in Ghost Admin API (CVSS 7.5)
- [CVE-2026-105652](https://cve.now/CVE-2026-105652.md): Ghost: Password Hash Ordering Disclosure in Ghost Admin API (CVSS 3.1)
- [CVE-2026-105651](https://cve.now/CVE-2026-105651.md): Ghost: Stored XSS via Bookmark Card Images (CVSS 7.3)
- [CVE-2026-105650](https://cve.now/CVE-2026-105650.md): Ghost: Stored XSS via oEmbed Photo Responses (CVSS 8.1)
- [CVE-2026-105649](https://cve.now/CVE-2026-105649.md): Ghost: Stored XSS via SVG Uploads Bypassing Sanitization (CVSS 7.3)
- [CVE-2026-105648](https://cve.now/CVE-2026-105648.md): Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses (CVSS 4.0)
- [CVE-2026-105647](https://cve.now/CVE-2026-105647.md): Ghost: Server-Side Request Forgery in Bookmark Fetching (CVSS 4.0)
- [CVE-2026-105646](https://cve.now/CVE-2026-105646.md): Ghost: Regular Expression Denial of Service in Content Import (CVSS 4.9)
- [CVE-2026-105645](https://cve.now/CVE-2026-105645.md): Ghost: Regular Expression Denial of Service in External Media Inliner (CVSS 4.9)
- [CVE-2026-105644](https://cve.now/CVE-2026-105644.md): Ghost: Stored XSS via SVG Files in Content Imports (CVSS 6.8)
- [CVE-2026-105643](https://cve.now/CVE-2026-105643.md): Ghost: Stored XSS via Embed Card Previews (CVSS 7.3)
- [CVE-2026-105642](https://cve.now/CVE-2026-105642.md): Ghost: Remote Code Execution via Bookmark Card Images (CVSS 8.8)
- [CVE-2026-104418](https://cve.now/CVE-2026-104418.md): Ghost from 6.10.3 before 6.64.0 RCE via Theme Translation Files (CVSS 8.6)
- [CVE-2026-104417](https://cve.now/CVE-2026-104417.md): Ghost 1.20.0 before 6.64.0 Path Traversal via Locale Setting (CVSS 6.9)
- [CVE-2026-104416](https://cve.now/CVE-2026-104416.md): Ghost 4.39.0 before 6.64.0 Invite Token Disclosure via Admin API (CVSS 7.7)
- [CVE-2026-104415](https://cve.now/CVE-2026-104415.md): Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin API (CVSS 2.3)
- [CVE-2026-104414](https://cve.now/CVE-2026-104414.md): Ghost from 2.5.0 before 6.64.0 Stored XSS via oEmbed Photo Responses (CVSS 8.6)
- [CVE-2026-104413](https://cve.now/CVE-2026-104413.md): Ghost 5.94.0 before 6.64.0 Stored XSS via Bookmark Card Images (CVSS 8.5)
- [CVE-2026-104412](https://cve.now/CVE-2026-104412.md): Ghost 0.5.0 before 6.64.0 Privilege Escalation via Staff Role Assignment (CVSS 5.3)
- [CVE-2026-104411](https://cve.now/CVE-2026-104411.md): Ghost 6.22.1 before 6.64.0 Stored XSS via Local Storage File Uploads (CVSS 8.5)
- [CVE-2026-103292](https://cve.now/CVE-2026-103292.md): Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost\_head (CVSS 8.6)
- [CVE-2026-103291](https://cve.now/CVE-2026-103291.md): Ghost 3.20.2 before 6.51.0 SSRF via image-size fetch (CVSS 5.3)
- [CVE-2026-103290](https://cve.now/CVE-2026-103290.md): Ghost 6.14.0 before 6.27.0 Path Traversal via ImageSize (CVSS 5.1)
- [CVE-2026-103289](https://cve.now/CVE-2026-103289.md): Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments (CVSS 7.1)
- [CVE-2026-103288](https://cve.now/CVE-2026-103288.md): Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like (CVSS 7.1)
- [CVE-2026-103287](https://cve.now/CVE-2026-103287.md): Ghost 1.18.0 before 6.27.0 Server-Side Request Forgery via Webhook (CVSS 5.1)
- [CVE-2026-103286](https://cve.now/CVE-2026-103286.md): Ghost 2.21.0 before 6.56.0 Privilege Escalation via Notifications (CVSS 8.5)
- [CVE-2026-103285](https://cve.now/CVE-2026-103285.md): Ghost 5.19.0 before 6.57.1 Cross-Site Request Forgery (CVSS 5.3)
- [CVE-2026-103284](https://cve.now/CVE-2026-103284.md): Ghost 5.125.1 before 6.57.1 Information Disclosure via Feedback (CVSS 5.3)
- [CVE-2026-103283](https://cve.now/CVE-2026-103283.md): Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling (CVSS 8.6)
- [CVE-2026-103282](https://cve.now/CVE-2026-103282.md): Ghost 0.5.0 before 6.23.0 Multiple Account Creation via Invite Token (CVSS 5.3)
- [CVE-2026-103281](https://cve.now/CVE-2026-103281.md): Ghost 3.23.0 before 6.23.0 API Key Exposure via Admin API (CVSS 5.3)
- [CVE-2026-103280](https://cve.now/CVE-2026-103280.md): Ghost 0.8.0 before 6.23.0 Information Disclosure via Setup Endpoint (CVSS 6.9)
- [CVE-2026-103279](https://cve.now/CVE-2026-103279.md): Ghost 3.10.0 before 6.34.0 Session Invalidation Bypass (CVSS 7.6)
- [CVE-2026-103278](https://cve.now/CVE-2026-103278.md): Ghost 5.8.0 before 6.34.0 Staff Account Takeover via Admin iframe (CVSS 8.5)
- [CVE-2026-103277](https://cve.now/CVE-2026-103277.md): Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed (CVSS 8.6)
- [CVE-2026-103276](https://cve.now/CVE-2026-103276.md): Ghost before 6.20.0 File Read via URL Encoding Bypass (CVSS 6.9)
- [CVE-2026-103275](https://cve.now/CVE-2026-103275.md): Ghost 5.42.2 before 6.58.0 Password Hash Disclosure (CVSS 5.3)
- [CVE-2026-103274](https://cve.now/CVE-2026-103274.md): Ghost 5.3.0 before 6.58.0 Unauthenticated Comment Read (CVSS 6.9)
- [CVE-2026-103273](https://cve.now/CVE-2026-103273.md): Ghost 4.3.0 before 6.58.0 Incorrect Authorization via Staff Token (CVSS 5.3)
- [CVE-2026-103272](https://cve.now/CVE-2026-103272.md): Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content API (CVSS 8.7)
- [CVE-2026-103271](https://cve.now/CVE-2026-103271.md): Ghost 4.0.0 before 6.63.0 Restricted Content Bypass (CVSS 8.7)
- [CVE-2026-103269](https://cve.now/CVE-2026-103269.md): Ghost 5.3.0 before 6.62.0 Missing Authorization via Post Excerpts (CVSS 6.9)
- [CVE-2026-103268](https://cve.now/CVE-2026-103268.md): Ghost 1.0.0 before 6.62.0 Suspension Bypass via Password Reset (CVSS 8.7)
- [CVE-2026-103267](https://cve.now/CVE-2026-103267.md): Ghost 0.5.0 before 6.62.0 Arbitrary Email Registration via Staff Invite (CVSS 5.3)
- [CVE-2026-103266](https://cve.now/CVE-2026-103266.md): Ghost 5.2.0 before 6.62.0 Unauthenticated Stripe Checkout Account Modification (CVSS 7.1)
- [CVE-2026-70596](https://cve.now/CVE-2026-70596.md): Ghost: Cross-Site Scripting in Feature Image Captions (CVSS 4.3)
- [CVE-2026-70595](https://cve.now/CVE-2026-70595.md): Ghost: Server-Side Request Forgery Mitigation Issue (CVSS 4.0)
- [CVE-2026-70594](https://cve.now/CVE-2026-70594.md): Ghost: Session Fixation in Ghost Admin (CVSS 6.7)
- [CVE-2026-70593](https://cve.now/CVE-2026-70593.md): Ghost: Theme Upload Path Traversal (CVSS 6.6)
- [CVE-2026-70592](https://cve.now/CVE-2026-70592.md): Ghost: Database Backup Path Traversal (CVSS 5.5)
- [CVE-2026-70591](https://cve.now/CVE-2026-70591.md): Ghost: Server-Side Request Forgery in Image Fetching (CVSS 4.1)
- [CVE-2026-70590](https://cve.now/CVE-2026-70590.md): Ghost: Blind Password Hash Disclosure in Ghost Admin API (CVSS 4.8)
- [CVE-2026-70589](https://cve.now/CVE-2026-70589.md): Ghost: Archived Offers can be Redeemed (CVSS 4.8)
- [CVE-2026-70588](https://cve.now/CVE-2026-70588.md): Ghost: Cross-Site Scripting in Universal Import (CVSS 5.0)
- [CVE-2026-25552](https://cve.now/CVE-2026-25552.md): Ghost CLI \< 1.30.1 IP Spoofing via X-Forwarded-For Header (CVSS 6.3)
- [CVE-2026-59817](https://cve.now/CVE-2026-59817.md): Ghost: Paid gift memberships obtainable at minimal cost via the donations feature (CVSS 5.3)
- [CVE-2026-53943](https://cve.now/CVE-2026-53943.md): Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header (CVSS 9.6)
- [CVE-2026-53944](https://cve.now/CVE-2026-53944.md): Ghost: Private IP filtering bypass to make server-side requests to internal services (CVSS 5.8)
- [CVE-2026-53945](https://cve.now/CVE-2026-53945.md): Ghost: Server-side request forgery via DNS rebinding in external request handling (CVSS 4.0)
- [CVE-2026-53946](https://cve.now/CVE-2026-53946.md): Ghost: Mobiledoc image-size fetch SSRF (CVSS 5.4)
- [CVE-2026-53947](https://cve.now/CVE-2026-53947.md): Ghost: Member existence leak via magic link sign-in response (CVSS 5.3)
- [CVE-2026-53948](https://cve.now/CVE-2026-53948.md): Ghost: File Upload Content-Type Spoofing (CVSS 5.4)
- [CVE-2026-53949](https://cve.now/CVE-2026-53949.md): Ghost Content API filter bypass reveals private fields (CVSS 5.3)
- [CVE-2026-53950](https://cve.now/CVE-2026-53950.md): @tryghost/activitypub: XSS in Ghost's ActivityPub client (CVSS 7.5)
- [CVE-2026-29784](https://cve.now/CVE-2026-29784.md): Ghost: Incomplete CSRF protections around OTC use (CVSS 7.5)
- [CVE-2026-29053](https://cve.now/CVE-2026-29053.md): Ghost Vulnerable to Remote Code Execution via Malicious Themes (CVSS 7.7)
- [CVE-2026-26980](https://cve.now/CVE-2026-26980.md): Ghost has a SQL Injection in its Content API (CVSS 9.4)
- [CVE-2026-24778](https://cve.now/CVE-2026-24778.md): Ghost vulnerable to XSS via malicious Portal preview links (CVSS 8.8)
- [CVE-2026-22597](https://cve.now/CVE-2026-22597.md): Ghost has SSRF via External Media Inliner (CVSS 5.1)
- [CVE-2026-22596](https://cve.now/CVE-2026-22596.md): Ghost has SQL Injection in Members Activity Feed (CVSS 6.7)
- [CVE-2026-22595](https://cve.now/CVE-2026-22595.md): Ghost has Staff Token permission bypass (CVSS 8.1)
- [CVE-2026-22594](https://cve.now/CVE-2026-22594.md): Ghost has Staff 2FA bypass (CVSS 8.1)
- [CVE-2024-43409](https://cve.now/CVE-2024-43409.md): Ghost's improper authentication allows access to member information and actions (CVSS 6.5)
- [CVE-2023-40028](https://cve.now/CVE-2023-40028.md): Arbitrary file read via symlinks in Ghost (CVSS 4.9)
- [CVE-2023-31133](https://cve.now/CVE-2023-31133.md): Ghost vulnerable to disclosure of private API fields (CVSS 7.5)
- [CVE-2021-39192](https://cve.now/CVE-2021-39192.md): Privilege escalation: all users can access Admin-level API keys (CVSS 6.5)
- [CVE-2021-32817](https://cve.now/CVE-2021-32817.md): File disclosure in express-hbs (CVSS 5.4)
- [CVE-2021-29484](https://cve.now/CVE-2021-29484.md): DOM XSS in Theme Preview (CVSS 6.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/tryghost
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.