{"schema_version":1,"title":"TryGhost Ghost vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 28 vulnerabilities in TryGhost Ghost: 0 in the last 7 days and 27 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-105680, was published on 5 October 2026. Nothing in the last four weeks, down from 27 vulnerabilities in the four before.","url":"https://junglewise.ai/threats/technologies/tryghost-ghost","json_url":"https://junglewise.ai/threats/technologies/tryghost-ghost.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/tryghost-ghost","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":9,"all_time":28,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":27,"last_365_days":27},"latest":[{"cve":"CVE-2026-105680","cvss":6.5,"epss":0.0027,"slug":"cve-2026-105680-ghost-is-a-node-js-content-management-system-from-5-81-0-until-6","title":"Ghost authorization bypass in post deletion","severity":"medium","exploited":false,"published_at":"2026-10-05T20:17:15.903+00:00","url":"https://junglewise.ai/threats/cve-2026-105680-ghost-is-a-node-js-content-management-system-from-5-81-0-until-6"},{"cve":"CVE-2026-105679","cvss":7.3,"epss":0.0024,"slug":"cve-2026-105679-ghost-is-a-node-js-content-management-system-from-6-22-1-until-6","title":"Ghost content type validation bypass in local file storage","severity":"high","exploited":false,"published_at":"2026-10-05T20:17:15.107+00:00","url":"https://junglewise.ai/threats/cve-2026-105679-ghost-is-a-node-js-content-management-system-from-6-22-1-until-6"},{"cve":"CVE-2026-105676","cvss":4.9,"epss":0.004,"slug":"cve-2026-105676-ghost-is-a-node-js-content-management-system-from-1-20-0-until-6","title":"Ghost path traversal in theme translation file loading","severity":"medium","exploited":false,"published_at":"2026-10-05T20:17:14.547+00:00","url":"https://junglewise.ai/threats/cve-2026-105676-ghost-is-a-node-js-content-management-system-from-1-20-0-until-6"},{"cve":"CVE-2026-105645","cvss":4.9,"epss":0.0033,"slug":"cve-2026-105645-ghost-is-a-node-js-content-management-system-from-5-37-0-until-6","title":"Ghost ReDoS in external media inliner","severity":"medium","exploited":false,"published_at":"2026-10-05T19:17:19.223+00:00","url":"https://junglewise.ai/threats/cve-2026-105645-ghost-is-a-node-js-content-management-system-from-5-37-0-until-6"},{"cve":"CVE-2026-105644","cvss":6.8,"epss":0.0032,"slug":"cve-2026-105644-ghost-is-a-node-js-content-management-system-from-4-0-0-until-6","title":"Ghost stored cross-site scripting in SVG image imports","severity":"medium","exploited":false,"published_at":"2026-10-05T19:17:19.06+00:00","url":"https://junglewise.ai/threats/cve-2026-105644-ghost-is-a-node-js-content-management-system-from-4-0-0-until-6"},{"cve":"CVE-2026-105642","cvss":8.8,"epss":0.0025,"slug":"cve-2026-105642-ghost-is-a-node-js-content-management-system-from-6-56-0-until-6","title":"Ghost remote code execution via bookmark card images","severity":"high","exploited":false,"published_at":"2026-10-05T19:17:18.733+00:00","url":"https://junglewise.ai/threats/cve-2026-105642-ghost-is-a-node-js-content-management-system-from-6-56-0-until-6"},{"cve":"CVE-2026-104418","cvss":7.2,"epss":0.0065,"slug":"cve-2026-104418-ghost-from-6-10-3-before-6-64-0-contains-a-remote-code-execution","title":"Ghost remote code execution via theme translation files","severity":"high","exploited":false,"published_at":"2026-10-02T12:17:11.71+00:00","url":"https://junglewise.ai/threats/cve-2026-104418-ghost-from-6-10-3-before-6-64-0-contains-a-remote-code-execution"},{"cve":"CVE-2026-104417","cvss":4.9,"epss":0.0037,"slug":"cve-2026-104417-ghost-from-1-20-0-before-6-64-0-contains-a-path-traversal","title":"Ghost path traversal in theme translation file loading","severity":"medium","exploited":false,"published_at":"2026-10-02T12:17:11.567+00:00","url":"https://junglewise.ai/threats/cve-2026-104417-ghost-from-1-20-0-before-6-64-0-contains-a-path-traversal"},{"cve":"CVE-2026-104416","cvss":7.5,"epss":0.0031,"slug":"cve-2026-104416-ghost-from-4-39-0-before-6-64-0-contains-an-information","title":"Ghost information disclosure in Admin API invite tokens","severity":"high","exploited":false,"published_at":"2026-10-02T12:17:11.42+00:00","url":"https://junglewise.ai/threats/cve-2026-104416-ghost-from-4-39-0-before-6-64-0-contains-an-information"},{"cve":"CVE-2026-104412","cvss":4.3,"epss":0.0019,"slug":"cve-2026-104412-ghost-0-5-0-before-6-64-0-does-not-correctly-restrict-staff-role","title":"Ghost staff role assignment privilege escalation","severity":"medium","exploited":false,"published_at":"2026-10-02T12:17:10.84+00:00","url":"https://junglewise.ai/threats/cve-2026-104412-ghost-0-5-0-before-6-64-0-does-not-correctly-restrict-staff-role"},{"cve":"CVE-2026-103292","cvss":8,"epss":0.0023,"slug":"cve-2026-103292-ghost-versions-from-0-5-3-through-versions-prior-to-6-50-0-fail","title":"Ghost JSON-LD cross-site scripting in ghost_head helper","severity":"high","exploited":false,"published_at":"2026-10-01T11:17:25.847+00:00","url":"https://junglewise.ai/threats/cve-2026-103292-ghost-versions-from-0-5-3-through-versions-prior-to-6-50-0-fail"},{"cve":"CVE-2026-103291","cvss":6.4,"epss":0.0014,"slug":"cve-2026-103291-ghost-versions-from-3-20-2-before-6-51-0-contain-a-server-side","title":"Ghost server-side request forgery in image dimension refetching","severity":"medium","exploited":false,"published_at":"2026-10-01T11:17:25.68+00:00","url":"https://junglewise.ai/threats/cve-2026-103291-ghost-versions-from-3-20-2-before-6-51-0-contain-a-server-side"},{"cve":"CVE-2026-103289","cvss":6.5,"epss":0.0023,"slug":"cve-2026-103289-ghost-from-5-9-0-before-6-44-1-contains-an-input-validation","title":"Ghost authorization bypass in comments feature","severity":"medium","exploited":false,"published_at":"2026-10-01T11:17:25.36+00:00","url":"https://junglewise.ai/threats/cve-2026-103289-ghost-from-5-9-0-before-6-44-1-contains-an-input-validation"},{"cve":"CVE-2026-103288","cvss":6.5,"epss":0.002,"slug":"cve-2026-103288-ghost-an-open-source-publishing-platform-contains-an-input","title":"Ghost authorization bypass in comment like feature","severity":"medium","exploited":false,"published_at":"2026-10-01T11:17:25.2+00:00","url":"https://junglewise.ai/threats/cve-2026-103288-ghost-an-open-source-publishing-platform-contains-an-input"},{"cve":"CVE-2026-103285","cvss":4.3,"epss":0.001,"slug":"cve-2026-103285-ghost-versions-from-5-19-0-before-6-57-1-contain-a-cross-site","title":"Ghost cross-site request forgery in post feedback","severity":"medium","exploited":false,"published_at":"2026-10-01T11:17:24.717+00:00","url":"https://junglewise.ai/threats/cve-2026-103285-ghost-versions-from-5-19-0-before-6-57-1-contain-a-cross-site"},{"cve":"CVE-2026-103284","cvss":4.3,"epss":0.0017,"slug":"cve-2026-103284-ghost-versions-from-5-125-1-before-6-57-1-contain-an-information","title":"Ghost information disclosure in Admin Feedback endpoint","severity":"medium","exploited":false,"published_at":"2026-10-01T11:17:24.557+00:00","url":"https://junglewise.ai/threats/cve-2026-103284-ghost-versions-from-5-125-1-before-6-57-1-contain-an-information"},{"cve":"CVE-2026-103283","cvss":8.1,"epss":0.0027,"slug":"cve-2026-103283-ghost-versions-6-20-0-before-6-57-1-contain-a-session-handling","title":"Ghost session handling authentication bypass via user impersonation","severity":"high","exploited":false,"published_at":"2026-10-01T11:17:24.397+00:00","url":"https://junglewise.ai/threats/cve-2026-103283-ghost-versions-6-20-0-before-6-57-1-contain-a-session-handling"},{"cve":"CVE-2026-103282","cvss":4.3,"epss":0.0014,"slug":"cve-2026-103282-ghost-versions-0-5-0-before-6-23-0-contain-a-concurrency-issue","title":"Ghost race condition in staff invitation acceptance mechanism","severity":"medium","exploited":false,"published_at":"2026-10-01T11:17:24.24+00:00","url":"https://junglewise.ai/threats/cve-2026-103282-ghost-versions-0-5-0-before-6-23-0-contain-a-concurrency-issue"},{"cve":"CVE-2026-103280","cvss":5.3,"epss":0.0021,"slug":"cve-2026-103280-ghost-from-version-0-8-0-before-6-23-0-contains-an-information","title":"Ghost information disclosure in setup endpoint","severity":"medium","exploited":false,"published_at":"2026-10-01T11:17:23.907+00:00","url":"https://junglewise.ai/threats/cve-2026-103280-ghost-from-version-0-8-0-before-6-23-0-contains-an-information"},{"cve":"CVE-2026-103279","cvss":6.8,"epss":0.0019,"slug":"cve-2026-103279-ghost-versions-from-3-10-0-before-6-34-0-fail-to-fully","title":"Ghost session invalidation bypass on password change","severity":"medium","exploited":false,"published_at":"2026-10-01T11:17:23.743+00:00","url":"https://junglewise.ai/threats/cve-2026-103279-ghost-versions-from-3-10-0-before-6-34-0-fail-to-fully"},{"cve":"CVE-2026-103278","cvss":7.3,"epss":0.0027,"slug":"cve-2026-103278-ghost-versions-5-8-0-before-6-34-0-contain-an-input-validation","title":"Ghost input validation in admin iframe allows staff account takeover","severity":"high","exploited":false,"published_at":"2026-10-01T11:17:23.567+00:00","url":"https://junglewise.ai/threats/cve-2026-103278-ghost-versions-5-8-0-before-6-34-0-contain-an-input-validation"},{"cve":"CVE-2026-103277","cvss":8.1,"epss":0.0027,"slug":"cve-2026-103277-ghost-versions-from-2-5-0-before-6-34-0-contain-an-untrusted","title":"Ghost oEmbed preview script injection vulnerability","severity":"high","exploited":false,"published_at":"2026-10-01T11:17:23.403+00:00","url":"https://junglewise.ai/threats/cve-2026-103277-ghost-versions-from-2-5-0-before-6-34-0-contain-an-untrusted"},{"cve":"CVE-2026-103276","cvss":5.3,"epss":0.0023,"slug":"cve-2026-103276-ghost-versions-before-6-20-0-contain-a-file-extension-filtering","title":"Ghost file extension filtering bypass in theme serving","severity":"medium","exploited":false,"published_at":"2026-10-01T11:17:23.237+00:00","url":"https://junglewise.ai/threats/cve-2026-103276-ghost-versions-before-6-20-0-contain-a-file-extension-filtering"},{"cve":"CVE-2026-103275","cvss":4.3,"epss":0.0021,"slug":"cve-2026-103275-ghost-5-42-2-before-6-58-0-contains-an-information-disclosure","title":"Ghost information disclosure in Admin API bulk endpoints","severity":"medium","exploited":false,"published_at":"2026-10-01T11:17:23.067+00:00","url":"https://junglewise.ai/threats/cve-2026-103275-ghost-5-42-2-before-6-58-0-contains-an-information-disclosure"},{"cve":"CVE-2026-103273","cvss":4.3,"epss":0.0026,"slug":"cve-2026-103273-ghost-versions-4-3-0-before-6-58-0-contain-an-authentication","title":"Ghost staff token authorization bypass in post editing","severity":"medium","exploited":false,"published_at":"2026-10-01T11:17:22.73+00:00","url":"https://junglewise.ai/threats/cve-2026-103273-ghost-versions-4-3-0-before-6-58-0-contain-an-authentication"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":21},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":6},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"TryGhost Ghost","slug":"tryghost-ghost","vendor":{"hub":true,"name":"TryGhost","slug":"tryghost","url":"https://junglewise.ai/threats/vendors/tryghost"},"aliases":[],"category":"cms","description":"TryGhost is a headless content management system designed for blogging and membership publishing.","url":"https://junglewise.ai/threats/technologies/tryghost-ghost"},"most_severe":[{"cve":"CVE-2026-105642","cvss":8.8,"epss":0.0025,"slug":"cve-2026-105642-ghost-is-a-node-js-content-management-system-from-6-56-0-until-6","title":"Ghost remote code execution via bookmark card images","severity":"high","exploited":false,"published_at":"2026-10-05T19:17:18.733+00:00","url":"https://junglewise.ai/threats/cve-2026-105642-ghost-is-a-node-js-content-management-system-from-6-56-0-until-6"},{"cve":"CVE-2026-103283","cvss":8.1,"epss":0.0027,"slug":"cve-2026-103283-ghost-versions-6-20-0-before-6-57-1-contain-a-session-handling","title":"Ghost session handling authentication bypass via user impersonation","severity":"high","exploited":false,"published_at":"2026-10-01T11:17:24.397+00:00","url":"https://junglewise.ai/threats/cve-2026-103283-ghost-versions-6-20-0-before-6-57-1-contain-a-session-handling"},{"cve":"CVE-2026-103277","cvss":8.1,"epss":0.0027,"slug":"cve-2026-103277-ghost-versions-from-2-5-0-before-6-34-0-contain-an-untrusted","title":"Ghost oEmbed preview script injection vulnerability","severity":"high","exploited":false,"published_at":"2026-10-01T11:17:23.403+00:00","url":"https://junglewise.ai/threats/cve-2026-103277-ghost-versions-from-2-5-0-before-6-34-0-contain-an-untrusted"},{"cve":"CVE-2026-103292","cvss":8,"epss":0.0023,"slug":"cve-2026-103292-ghost-versions-from-0-5-3-through-versions-prior-to-6-50-0-fail","title":"Ghost JSON-LD cross-site scripting in ghost_head helper","severity":"high","exploited":false,"published_at":"2026-10-01T11:17:25.847+00:00","url":"https://junglewise.ai/threats/cve-2026-103292-ghost-versions-from-0-5-3-through-versions-prior-to-6-50-0-fail"},{"cve":"CVE-2026-103272","cvss":7.5,"epss":0.0037,"slug":"cve-2026-103272-ghost-versions-from-2-10-0-before-6-63-0-contain-a-staff","title":"Ghost staff enumeration vulnerability in content API","severity":"high","exploited":false,"published_at":"2026-10-01T11:17:22.563+00:00","url":"https://junglewise.ai/threats/cve-2026-103272-ghost-versions-from-2-10-0-before-6-63-0-contain-a-staff"},{"cve":"CVE-2026-104416","cvss":7.5,"epss":0.0031,"slug":"cve-2026-104416-ghost-from-4-39-0-before-6-64-0-contains-an-information","title":"Ghost information disclosure in Admin API invite tokens","severity":"high","exploited":false,"published_at":"2026-10-02T12:17:11.42+00:00","url":"https://junglewise.ai/threats/cve-2026-104416-ghost-from-4-39-0-before-6-64-0-contains-an-information"},{"cve":"CVE-2026-103278","cvss":7.3,"epss":0.0027,"slug":"cve-2026-103278-ghost-versions-5-8-0-before-6-34-0-contain-an-input-validation","title":"Ghost input validation in admin iframe allows staff account takeover","severity":"high","exploited":false,"published_at":"2026-10-01T11:17:23.567+00:00","url":"https://junglewise.ai/threats/cve-2026-103278-ghost-versions-5-8-0-before-6-34-0-contain-an-input-validation"},{"cve":"CVE-2026-105679","cvss":7.3,"epss":0.0024,"slug":"cve-2026-105679-ghost-is-a-node-js-content-management-system-from-6-22-1-until-6","title":"Ghost content type validation bypass in local file storage","severity":"high","exploited":false,"published_at":"2026-10-05T20:17:15.107+00:00","url":"https://junglewise.ai/threats/cve-2026-105679-ghost-is-a-node-js-content-management-system-from-6-22-1-until-6"},{"cve":"CVE-2026-104418","cvss":7.2,"epss":0.0065,"slug":"cve-2026-104418-ghost-from-6-10-3-before-6-64-0-contains-a-remote-code-execution","title":"Ghost remote code execution via theme translation files","severity":"high","exploited":false,"published_at":"2026-10-02T12:17:11.71+00:00","url":"https://junglewise.ai/threats/cve-2026-104418-ghost-from-6-10-3-before-6-64-0-contains-a-remote-code-execution"},{"cve":"CVE-2026-105644","cvss":6.8,"epss":0.0032,"slug":"cve-2026-105644-ghost-is-a-node-js-content-management-system-from-4-0-0-until-6","title":"Ghost stored cross-site scripting in SVG image imports","severity":"medium","exploited":false,"published_at":"2026-10-05T19:17:19.06+00:00","url":"https://junglewise.ai/threats/cve-2026-105644-ghost-is-a-node-js-content-management-system-from-4-0-0-until-6"}],"generated_at":"2026-11-09T03:07:00.176479+00:00"}