{"schema_version":1,"title":"Ghost vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 30 vulnerabilities in Ghost: 0 in the last 7 days and 21 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-105681, was published on 5 October 2026. Nothing in the last four weeks, down from 21 vulnerabilities in the four before.","url":"https://junglewise.ai/threats/technologies/ghost-ghost","json_url":"https://junglewise.ai/threats/technologies/ghost-ghost.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/ghost-ghost","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":13,"all_time":30,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":21,"last_365_days":26},"latest":[{"cve":"CVE-2026-105681","cvss":6.5,"epss":0.0026,"slug":"cve-2026-105681-ghost-is-a-node-js-content-management-system-from-5-9-0-until-6","title":"Ghost input validation bypass in comments access control","severity":"medium","exploited":false,"published_at":"2026-10-05T20:17:16.32+00:00","url":"https://junglewise.ai/threats/cve-2026-105681-ghost-is-a-node-js-content-management-system-from-5-9-0-until-6"},{"cve":"CVE-2026-105678","cvss":4.3,"epss":0.002,"slug":"cve-2026-105678-ghost-is-a-node-js-content-management-system-from-0-5-0-until-6","title":"Ghost privilege escalation via user role assignment","severity":"medium","exploited":false,"published_at":"2026-10-05T20:17:14.913+00:00","url":"https://junglewise.ai/threats/cve-2026-105678-ghost-is-a-node-js-content-management-system-from-0-5-0-until-6"},{"cve":"CVE-2026-105677","cvss":7.2,"epss":0.0052,"slug":"cve-2026-105677-ghost-is-a-node-js-content-management-system-from-6-10-3-until-6","title":"Ghost arbitrary code execution in theme translation loading","severity":"high","exploited":false,"published_at":"2026-10-05T20:17:14.733+00:00","url":"https://junglewise.ai/threats/cve-2026-105677-ghost-is-a-node-js-content-management-system-from-6-10-3-until-6"},{"cve":"CVE-2026-105675","cvss":7.5,"epss":0.0039,"slug":"cve-2026-105675-ghost-is-a-node-js-content-management-system-from-4-39-0-until-6","title":"Ghost privilege escalation via staff invite token disclosure","severity":"high","exploited":false,"published_at":"2026-10-05T20:17:14.367+00:00","url":"https://junglewise.ai/threats/cve-2026-105675-ghost-is-a-node-js-content-management-system-from-4-39-0-until-6"},{"cve":"CVE-2026-105651","cvss":7.3,"epss":0.003,"slug":"cve-2026-105651-ghost-is-a-node-js-content-management-system-from-5-94-0-until-6","title":"Ghost CMS arbitrary file storage in bookmark cards","severity":"high","exploited":false,"published_at":"2026-10-05T20:17:14.01+00:00","url":"https://junglewise.ai/threats/cve-2026-105651-ghost-is-a-node-js-content-management-system-from-5-94-0-until-6"},{"cve":"CVE-2026-105650","cvss":8.1,"epss":0.0033,"slug":"cve-2026-105650-ghost-is-a-node-js-content-management-system-from-2-1-0-until-6","title":"Ghost CMS stored XSS via oEmbed photo URLs","severity":"high","exploited":false,"published_at":"2026-10-05T20:17:13.817+00:00","url":"https://junglewise.ai/threats/cve-2026-105650-ghost-is-a-node-js-content-management-system-from-2-1-0-until-6"},{"cve":"CVE-2026-105649","cvss":7.3,"epss":0.003,"slug":"cve-2026-105649-ghost-is-a-node-js-content-management-system-from-4-22-0-until-6","title":"Ghost stored XSS via unvalidated SVG thumbnails","severity":"high","exploited":false,"published_at":"2026-10-05T20:17:13.613+00:00","url":"https://junglewise.ai/threats/cve-2026-105649-ghost-is-a-node-js-content-management-system-from-4-22-0-until-6"},{"cve":"CVE-2026-105648","cvss":4,"epss":0.003,"slug":"cve-2026-105648-ghost-is-a-node-js-content-management-system-from-6-0-9-until-6","title":"Ghost SSRF validation issue in Webmentions","severity":"medium","exploited":false,"published_at":"2026-10-05T20:17:13.42+00:00","url":"https://junglewise.ai/threats/cve-2026-105648-ghost-is-a-node-js-content-management-system-from-6-0-9-until-6"},{"cve":"CVE-2026-105647","cvss":4,"epss":0.0023,"slug":"cve-2026-105647-ghost-is-a-node-js-content-management-system-from-6-54-1-until-6","title":"Ghost Node.js CMS SSRF in Webmentions","severity":"medium","exploited":false,"published_at":"2026-10-05T20:17:13.157+00:00","url":"https://junglewise.ai/threats/cve-2026-105647-ghost-is-a-node-js-content-management-system-from-6-54-1-until-6"},{"cve":"CVE-2026-105646","cvss":4.9,"epss":0.0033,"slug":"cve-2026-105646-ghost-is-a-node-js-content-management-system-from-4-0-0-until-6","title":"Ghost regex denial of service in content import","severity":"medium","exploited":false,"published_at":"2026-10-05T19:17:19.373+00:00","url":"https://junglewise.ai/threats/cve-2026-105646-ghost-is-a-node-js-content-management-system-from-4-0-0-until-6"},{"cve":"CVE-2026-105643","cvss":7.3,"epss":0.0027,"slug":"cve-2026-105643-ghost-is-a-node-js-content-management-system-from-version-6-34-0","title":"Ghost stored cross-site scripting via embed card preview","severity":"high","exploited":false,"published_at":"2026-10-05T19:17:18.9+00:00","url":"https://junglewise.ai/threats/cve-2026-105643-ghost-is-a-node-js-content-management-system-from-version-6-34-0"},{"cve":"CVE-2026-104414","cvss":8.1,"epss":0.0028,"slug":"cve-2026-104414-ghost-from-2-5-0-before-6-64-0-contains-a-stored-cross-site","title":"Ghost stored cross-site scripting via oEmbed photo responses","severity":"high","exploited":false,"published_at":"2026-10-02T12:17:11.127+00:00","url":"https://junglewise.ai/threats/cve-2026-104414-ghost-from-2-5-0-before-6-64-0-contains-a-stored-cross-site"},{"cve":"CVE-2026-104413","cvss":7.3,"epss":0.0026,"slug":"cve-2026-104413-ghost-from-5-94-0-before-6-64-0-contains-a-stored-cross-site","title":"Ghost stored cross-site scripting in bookmark card images","severity":"high","exploited":false,"published_at":"2026-10-02T12:17:10.98+00:00","url":"https://junglewise.ai/threats/cve-2026-104413-ghost-from-5-94-0-before-6-64-0-contains-a-stored-cross-site"},{"cve":"CVE-2026-104411","cvss":7.3,"epss":0.0026,"slug":"cve-2026-104411-ghost-from-6-22-1-before-6-64-0-contains-a-stored-cross-site","title":"Ghost stored cross-site scripting via file uploads on local storage","severity":"high","exploited":false,"published_at":"2026-10-02T12:17:10.69+00:00","url":"https://junglewise.ai/threats/cve-2026-104411-ghost-from-6-22-1-before-6-64-0-contains-a-stored-cross-site"},{"cvss":6.5,"slug":"duplicate-advisory-ghost-authorization-bypass-in-comment-like-feature-5ea74582","title":"Ghost authorization bypass in comment like feature","severity":"medium","exploited":false,"published_at":"2026-10-01T12:31:19+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-ghost-authorization-bypass-in-comment-like-feature-5ea74582"},{"cve":"CVE-2026-103286","cvss":7.3,"epss":0.0019,"slug":"cve-2026-103286-ghost-versions-from-2-21-0-before-6-56-0-contain-a-privilege","title":"Ghost privilege escalation in notifications system","severity":"high","exploited":false,"published_at":"2026-10-01T11:17:24.88+00:00","url":"https://junglewise.ai/threats/cve-2026-103286-ghost-versions-from-2-21-0-before-6-56-0-contain-a-privilege"},{"cve":"CVE-2026-103274","cvss":5.3,"epss":0.0021,"slug":"cve-2026-103274-ghost-versions-5-3-0-before-6-58-0-fail-to-properly-enforce","title":"Ghost access control bypass on private comments","severity":"medium","exploited":false,"published_at":"2026-10-01T11:17:22.897+00:00","url":"https://junglewise.ai/threats/cve-2026-103274-ghost-versions-5-3-0-before-6-58-0-fail-to-properly-enforce"},{"cve":"CVE-2026-103271","cvss":7.5,"epss":0.0038,"slug":"cve-2026-103271-ghost-versions-from-4-0-0-before-6-63-0-contain-a-content-api","title":"Ghost content API authentication bypass in gated posts","severity":"high","exploited":false,"published_at":"2026-10-01T11:17:22.407+00:00","url":"https://junglewise.ai/threats/cve-2026-103271-ghost-versions-from-4-0-0-before-6-63-0-contain-a-content-api"},{"cve":"CVE-2026-103268","cvss":8.8,"epss":0.0032,"slug":"cve-2026-103268-ghost-versions-before-6-62-0-contain-an-authentication-bypass","title":"Ghost authentication bypass in password reset","severity":"high","exploited":false,"published_at":"2026-10-01T11:17:22.073+00:00","url":"https://junglewise.ai/threats/cve-2026-103268-ghost-versions-before-6-62-0-contain-an-authentication-bypass"},{"cve":"CVE-2026-103267","cvss":4.3,"epss":0.0026,"slug":"cve-2026-103267-ghost-versions-before-6-62-0-contain-an-authentication-bypass","title":"Ghost authentication bypass in staff invite acceptance","severity":"medium","exploited":false,"published_at":"2026-10-01T11:17:21.9+00:00","url":"https://junglewise.ai/threats/cve-2026-103267-ghost-versions-before-6-62-0-contain-an-authentication-bypass"},{"cve":"CVE-2026-103266","cvss":7.1,"epss":0.003,"slug":"cve-2026-103266-ghost-versions-5-2-0-through-versions-prior-to-6-62-0-allow-a","title":"Ghost unauthenticated member modification and HTML injection in newsletters","severity":"high","exploited":false,"published_at":"2026-10-01T11:17:21.737+00:00","url":"https://junglewise.ai/threats/cve-2026-103266-ghost-versions-5-2-0-through-versions-prior-to-6-62-0-allow-a"},{"cve":"CVE-2026-24778","cvss":3.1,"epss":0.0029,"slug":"cve-2026-24778-ghost-xss-via-malicious-portal-preview-links","title":"Ghost XSS via malicious Portal preview links","severity":"low","exploited":false,"published_at":"2026-01-28T16:11:59+00:00","url":"https://junglewise.ai/threats/cve-2026-24778-ghost-xss-via-malicious-portal-preview-links"},{"cve":"CVE-2026-22596","cvss":3.1,"epss":0.0047,"slug":"cve-2026-22596-ghost-sql-injection-in-members-activity-feed","title":"Ghost SQL injection in Members Activity Feed","severity":"low","exploited":false,"published_at":"2026-01-08T21:36:37+00:00","url":"https://junglewise.ai/threats/cve-2026-22596-ghost-sql-injection-in-members-activity-feed"},{"cve":"CVE-2026-22597","cvss":4,"epss":0.003,"slug":"cve-2026-22597-ghost-ssrf-via-external-media-inliner","title":"Ghost SSRF via External Media Inliner","severity":"medium","exploited":false,"published_at":"2026-01-08T21:36:03+00:00","url":"https://junglewise.ai/threats/cve-2026-22597-ghost-ssrf-via-external-media-inliner"},{"cve":"CVE-2026-22595","cvss":3.1,"epss":0.0055,"slug":"cve-2026-22595-ghost-staff-token-permission-bypass","title":"Ghost Staff Token permission bypass","severity":"low","exploited":false,"published_at":"2026-01-08T21:32:53+00:00","url":"https://junglewise.ai/threats/cve-2026-22595-ghost-staff-token-permission-bypass"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":10},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":11},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"Ghost","slug":"ghost-ghost","vendor":{"hub":true,"name":"Ghost","slug":"ghost","url":"https://junglewise.ai/threats/vendors/ghost"},"aliases":[],"category":"cms","description":"Open-source headless content management system for publishing and blogging.","url":"https://junglewise.ai/threats/technologies/ghost-ghost"},"most_severe":[{"cve":"CVE-2026-103268","cvss":8.8,"epss":0.0032,"slug":"cve-2026-103268-ghost-versions-before-6-62-0-contain-an-authentication-bypass","title":"Ghost authentication bypass in password reset","severity":"high","exploited":false,"published_at":"2026-10-01T11:17:22.073+00:00","url":"https://junglewise.ai/threats/cve-2026-103268-ghost-versions-before-6-62-0-contain-an-authentication-bypass"},{"cve":"CVE-2026-105650","cvss":8.1,"epss":0.0033,"slug":"cve-2026-105650-ghost-is-a-node-js-content-management-system-from-2-1-0-until-6","title":"Ghost CMS stored XSS via oEmbed photo URLs","severity":"high","exploited":false,"published_at":"2026-10-05T20:17:13.817+00:00","url":"https://junglewise.ai/threats/cve-2026-105650-ghost-is-a-node-js-content-management-system-from-2-1-0-until-6"},{"cve":"CVE-2026-104414","cvss":8.1,"epss":0.0028,"slug":"cve-2026-104414-ghost-from-2-5-0-before-6-64-0-contains-a-stored-cross-site","title":"Ghost stored cross-site scripting via oEmbed photo responses","severity":"high","exploited":false,"published_at":"2026-10-02T12:17:11.127+00:00","url":"https://junglewise.ai/threats/cve-2026-104414-ghost-from-2-5-0-before-6-64-0-contains-a-stored-cross-site"},{"cve":"CVE-2026-105675","cvss":7.5,"epss":0.0039,"slug":"cve-2026-105675-ghost-is-a-node-js-content-management-system-from-4-39-0-until-6","title":"Ghost privilege escalation via staff invite token disclosure","severity":"high","exploited":false,"published_at":"2026-10-05T20:17:14.367+00:00","url":"https://junglewise.ai/threats/cve-2026-105675-ghost-is-a-node-js-content-management-system-from-4-39-0-until-6"},{"cve":"CVE-2026-103271","cvss":7.5,"epss":0.0038,"slug":"cve-2026-103271-ghost-versions-from-4-0-0-before-6-63-0-contain-a-content-api","title":"Ghost content API authentication bypass in gated posts","severity":"high","exploited":false,"published_at":"2026-10-01T11:17:22.407+00:00","url":"https://junglewise.ai/threats/cve-2026-103271-ghost-versions-from-4-0-0-before-6-63-0-contain-a-content-api"},{"cve":"CVE-2026-105651","cvss":7.3,"epss":0.003,"slug":"cve-2026-105651-ghost-is-a-node-js-content-management-system-from-5-94-0-until-6","title":"Ghost CMS arbitrary file storage in bookmark cards","severity":"high","exploited":false,"published_at":"2026-10-05T20:17:14.01+00:00","url":"https://junglewise.ai/threats/cve-2026-105651-ghost-is-a-node-js-content-management-system-from-5-94-0-until-6"},{"cve":"CVE-2026-105649","cvss":7.3,"epss":0.003,"slug":"cve-2026-105649-ghost-is-a-node-js-content-management-system-from-4-22-0-until-6","title":"Ghost stored XSS via unvalidated SVG thumbnails","severity":"high","exploited":false,"published_at":"2026-10-05T20:17:13.613+00:00","url":"https://junglewise.ai/threats/cve-2026-105649-ghost-is-a-node-js-content-management-system-from-4-22-0-until-6"},{"cve":"CVE-2026-105643","cvss":7.3,"epss":0.0027,"slug":"cve-2026-105643-ghost-is-a-node-js-content-management-system-from-version-6-34-0","title":"Ghost stored cross-site scripting via embed card preview","severity":"high","exploited":false,"published_at":"2026-10-05T19:17:18.9+00:00","url":"https://junglewise.ai/threats/cve-2026-105643-ghost-is-a-node-js-content-management-system-from-version-6-34-0"},{"cve":"CVE-2026-104413","cvss":7.3,"epss":0.0026,"slug":"cve-2026-104413-ghost-from-5-94-0-before-6-64-0-contains-a-stored-cross-site","title":"Ghost stored cross-site scripting in bookmark card images","severity":"high","exploited":false,"published_at":"2026-10-02T12:17:10.98+00:00","url":"https://junglewise.ai/threats/cve-2026-104413-ghost-from-5-94-0-before-6-64-0-contains-a-stored-cross-site"},{"cve":"CVE-2026-104411","cvss":7.3,"epss":0.0026,"slug":"cve-2026-104411-ghost-from-6-22-1-before-6-64-0-contains-a-stored-cross-site","title":"Ghost stored cross-site scripting via file uploads on local storage","severity":"high","exploited":false,"published_at":"2026-10-02T12:17:10.69+00:00","url":"https://junglewise.ai/threats/cve-2026-104411-ghost-from-6-22-1-before-6-64-0-contains-a-stored-cross-site"}],"generated_at":"2026-11-09T03:07:00.176479+00:00"}