Vendor
Ghost vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 41 vulnerabilities in Ghost: 0 in the last 7 days and 22 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-63115, was published on 30 October 2026. 1 vulnerability in the last four weeks, down 95% on the four before (21). 1 technology has a page of its own.
- Last 7 days
- 0
- Last 90 days
- 22
- Critical, all time
- 0
- Exploited in the wild
- 0
About Ghost
Open-source headless content management system for building websites and applications.
Ghost technologies
- Ghost30
Latest Ghost vulnerabilities
- CVE-2026-63115: Ghost ActivityPub Undo handler impersonationmediumCVSS 5.3
- CVE-2026-105681: Ghost input validation bypass in comments access controlmediumCVSS 6.5EPSS 0.3%
- CVE-2026-105678: Ghost privilege escalation via user role assignmentmediumCVSS 4.3EPSS 0.2%
- CVE-2026-105677: Ghost arbitrary code execution in theme translation loadinghighCVSS 7.2EPSS 0.5%
- CVE-2026-105675: Ghost privilege escalation via staff invite token disclosurehighCVSS 7.5EPSS 0.4%
- CVE-2026-105651: Ghost CMS arbitrary file storage in bookmark cardshighCVSS 7.3EPSS 0.3%
- CVE-2026-105650: Ghost CMS stored XSS via oEmbed photo URLshighCVSS 8.1EPSS 0.3%
- CVE-2026-105649: Ghost stored XSS via unvalidated SVG thumbnailshighCVSS 7.3EPSS 0.3%
- CVE-2026-105648: Ghost SSRF validation issue in WebmentionsmediumCVSS 4EPSS 0.3%
- CVE-2026-105647: Ghost Node.js CMS SSRF in WebmentionsmediumCVSS 4EPSS 0.2%
- CVE-2026-105646: Ghost regex denial of service in content importmediumCVSS 4.9EPSS 0.3%
- CVE-2026-105643: Ghost stored cross-site scripting via embed card previewhighCVSS 7.3EPSS 0.3%
- CVE-2026-104414: Ghost stored cross-site scripting via oEmbed photo responseshighCVSS 8.1EPSS 0.3%
- CVE-2026-104413: Ghost stored cross-site scripting in bookmark card imageshighCVSS 7.3EPSS 0.3%
- CVE-2026-104411: Ghost stored cross-site scripting via file uploads on local storagehighCVSS 7.3EPSS 0.3%
- Ghost authorization bypass in comment like featuremediumCVSS 6.5
- CVE-2026-103286: Ghost privilege escalation in notifications systemhighCVSS 7.3EPSS 0.2%
- CVE-2026-103274: Ghost access control bypass on private commentsmediumCVSS 5.3EPSS 0.2%
- CVE-2026-103271: Ghost content API authentication bypass in gated postshighCVSS 7.5EPSS 0.4%
- CVE-2026-103268: Ghost authentication bypass in password resethighCVSS 8.8EPSS 0.3%
- CVE-2026-103267: Ghost authentication bypass in staff invite acceptancemediumCVSS 4.3EPSS 0.3%
- CVE-2026-103266: Ghost unauthenticated member modification and HTML injection in newslettershighCVSS 7.1EPSS 0.3%
- CVE-2026-70589: Ghost improper validation of archived subscription offersmediumCVSS 4.8EPSS 0.3%
- CVE-2026-29784: Ghost incomplete CSRF protections in OTC loginlowCVSS 3.1EPSS 0.2%
- CVE-2026-24778: Ghost XSS via malicious Portal preview linkslowCVSS 3.1EPSS 0.3%
Most severe Ghost vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-103268: Ghost authentication bypass in password resethighCVSS 8.8EPSS 0.3%
- CVE-2026-105650: Ghost CMS stored XSS via oEmbed photo URLshighCVSS 8.1EPSS 0.3%
- CVE-2026-104414: Ghost stored cross-site scripting via oEmbed photo responseshighCVSS 8.1EPSS 0.3%
- CVE-2026-105675: Ghost privilege escalation via staff invite token disclosurehighCVSS 7.5EPSS 0.4%
- CVE-2026-103271: Ghost content API authentication bypass in gated postshighCVSS 7.5EPSS 0.4%
- CVE-2026-105651: Ghost CMS arbitrary file storage in bookmark cardshighCVSS 7.3EPSS 0.3%
- CVE-2026-105649: Ghost stored XSS via unvalidated SVG thumbnailshighCVSS 7.3EPSS 0.3%
- CVE-2026-105643: Ghost stored cross-site scripting via embed card previewhighCVSS 7.3EPSS 0.3%
- CVE-2026-104413: Ghost stored cross-site scripting in bookmark card imageshighCVSS 7.3EPSS 0.3%
- CVE-2026-104411: Ghost stored cross-site scripting via file uploads on local storagehighCVSS 7.3EPSS 0.3%
Vulnerabilities per week
1 vulnerability in the last four weeks, down 95% on the four before (21). The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 10 | 0 | |
| 5 Oct 2026 | 11 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 1 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Ghost vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/ghost)<a href="https://junglewise.ai/threats/vendors/ghost"><img src="https://junglewise.ai/threats/vendors/ghost/badge.svg" alt="Ghost vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/ghost.json, and this page as text at https://junglewise.ai/threats/vendors/ghost.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Ghost vulnerabilities", https://junglewise.ai/threats/vendors/ghost, 9 November 2026.