Tryghost vulnerabilities
88 CVEs and advisories name Tryghost as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-103291Ghost 3.20.2 before 6.51.0 SSRF via image-size fetch
- CVE-2026-103290Ghost 6.14.0 before 6.27.0 Path Traversal via ImageSize
- CVE-2026-103289Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments
- CVE-2026-103288Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like
- CVE-2026-103287Ghost 1.18.0 before 6.27.0 Server-Side Request Forgery via Webhook
- CVE-2026-103286Ghost 2.21.0 before 6.56.0 Privilege Escalation via Notifications
- CVE-2026-103285Ghost 5.19.0 before 6.57.1 Cross-Site Request Forgery
- CVE-2026-103284Ghost 5.125.1 before 6.57.1 Information Disclosure via Feedback
- CVE-2026-103283Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling
- CVE-2026-103282Ghost 0.5.0 before 6.23.0 Multiple Account Creation via Invite Token
- CVE-2026-103281Ghost 3.23.0 before 6.23.0 API Key Exposure via Admin API
- CVE-2026-103280Ghost 0.8.0 before 6.23.0 Information Disclosure via Setup Endpoint
- CVE-2026-103279Ghost 3.10.0 before 6.34.0 Session Invalidation Bypass
- CVE-2026-103278Ghost 5.8.0 before 6.34.0 Staff Account Takeover via Admin iframe
- CVE-2026-103277Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed
- CVE-2026-103276Ghost before 6.20.0 File Read via URL Encoding Bypass
- CVE-2026-103275Ghost 5.42.2 before 6.58.0 Password Hash Disclosure
- CVE-2026-103274Ghost 5.3.0 before 6.58.0 Unauthenticated Comment Read
- CVE-2026-103273Ghost 4.3.0 before 6.58.0 Incorrect Authorization via Staff Token
- CVE-2026-103272Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content API
- CVE-2026-103271Ghost 4.0.0 before 6.63.0 Restricted Content Bypass
- CVE-2026-103269Ghost 5.3.0 before 6.62.0 Missing Authorization via Post Excerpts
- CVE-2026-103268Ghost 1.0.0 before 6.62.0 Suspension Bypass via Password Reset
- CVE-2026-103267Ghost 0.5.0 before 6.62.0 Arbitrary Email Registration via Staff Invite
- CVE-2026-103266Ghost 5.2.0 before 6.62.0 Unauthenticated Stripe Checkout Account Modification
- CVE-2026-70596Ghost: Cross-Site Scripting in Feature Image Captions
- CVE-2026-70595Ghost: Server-Side Request Forgery Mitigation Issue
- CVE-2026-70594Ghost: Session Fixation in Ghost Admin
- CVE-2026-70593Ghost: Theme Upload Path Traversal
- CVE-2026-70592Ghost: Database Backup Path Traversal