# TryGhost vulnerabilities Source: https://junglewise.ai/threats/vendors/tryghost Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/tryghost.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 31 vulnerabilities in TryGhost: 0 in the last 7 days and 27 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-105680, was published on 5 October 2026. Nothing in the last four weeks, down from 27 vulnerabilities in the four before. 1 technology has a page of its own. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 27 - All time: 31 (0 critical, 0 exploited in the wild) ## About TryGhost TryGhost is an open-source platform for creating and managing membership-based publications. ## Latest TryGhost vulnerabilities - [CVE-2026-105680: Ghost authorization bypass in post deletion](https://junglewise.ai/threats/cve-2026-105680-ghost-is-a-node-js-content-management-system-from-5-81-0-until-6) (medium, CVSS 6.5, published 5 Oct 2026) - [CVE-2026-105679: Ghost content type validation bypass in local file storage](https://junglewise.ai/threats/cve-2026-105679-ghost-is-a-node-js-content-management-system-from-6-22-1-until-6) (high, CVSS 7.3, published 5 Oct 2026) - [CVE-2026-105676: Ghost path traversal in theme translation file loading](https://junglewise.ai/threats/cve-2026-105676-ghost-is-a-node-js-content-management-system-from-1-20-0-until-6) (medium, CVSS 4.9, published 5 Oct 2026) - [CVE-2026-105645: Ghost ReDoS in external media inliner](https://junglewise.ai/threats/cve-2026-105645-ghost-is-a-node-js-content-management-system-from-5-37-0-until-6) (medium, CVSS 4.9, published 5 Oct 2026) - [CVE-2026-105644: Ghost stored cross-site scripting in SVG image imports](https://junglewise.ai/threats/cve-2026-105644-ghost-is-a-node-js-content-management-system-from-4-0-0-until-6) (medium, CVSS 6.8, published 5 Oct 2026) - [CVE-2026-105642: Ghost remote code execution via bookmark card images](https://junglewise.ai/threats/cve-2026-105642-ghost-is-a-node-js-content-management-system-from-6-56-0-until-6) (high, CVSS 8.8, published 5 Oct 2026) - [CVE-2026-104418: Ghost remote code execution via theme translation files](https://junglewise.ai/threats/cve-2026-104418-ghost-from-6-10-3-before-6-64-0-contains-a-remote-code-execution) (high, CVSS 7.2, published 2 Oct 2026) - [CVE-2026-104417: Ghost path traversal in theme translation file loading](https://junglewise.ai/threats/cve-2026-104417-ghost-from-1-20-0-before-6-64-0-contains-a-path-traversal) (medium, CVSS 4.9, published 2 Oct 2026) - [CVE-2026-104416: Ghost information disclosure in Admin API invite tokens](https://junglewise.ai/threats/cve-2026-104416-ghost-from-4-39-0-before-6-64-0-contains-an-information) (high, CVSS 7.5, published 2 Oct 2026) - [CVE-2026-104412: Ghost staff role assignment privilege escalation](https://junglewise.ai/threats/cve-2026-104412-ghost-0-5-0-before-6-64-0-does-not-correctly-restrict-staff-role) (medium, CVSS 4.3, published 2 Oct 2026) - [CVE-2026-103292: Ghost JSON-LD cross-site scripting in ghost_head helper](https://junglewise.ai/threats/cve-2026-103292-ghost-versions-from-0-5-3-through-versions-prior-to-6-50-0-fail) (high, CVSS 8, published 1 Oct 2026) - [CVE-2026-103291: Ghost server-side request forgery in image dimension refetching](https://junglewise.ai/threats/cve-2026-103291-ghost-versions-from-3-20-2-before-6-51-0-contain-a-server-side) (medium, CVSS 6.4, published 1 Oct 2026) - [CVE-2026-103289: Ghost authorization bypass in comments feature](https://junglewise.ai/threats/cve-2026-103289-ghost-from-5-9-0-before-6-44-1-contains-an-input-validation) (medium, CVSS 6.5, published 1 Oct 2026) - [CVE-2026-103288: Ghost authorization bypass in comment like feature](https://junglewise.ai/threats/cve-2026-103288-ghost-an-open-source-publishing-platform-contains-an-input) (medium, CVSS 6.5, published 1 Oct 2026) - [CVE-2026-103285: Ghost cross-site request forgery in post feedback](https://junglewise.ai/threats/cve-2026-103285-ghost-versions-from-5-19-0-before-6-57-1-contain-a-cross-site) (medium, CVSS 4.3, published 1 Oct 2026) - [CVE-2026-103284: Ghost information disclosure in Admin Feedback endpoint](https://junglewise.ai/threats/cve-2026-103284-ghost-versions-from-5-125-1-before-6-57-1-contain-an-information) (medium, CVSS 4.3, published 1 Oct 2026) - [CVE-2026-103283: Ghost session handling authentication bypass via user impersonation](https://junglewise.ai/threats/cve-2026-103283-ghost-versions-6-20-0-before-6-57-1-contain-a-session-handling) (high, CVSS 8.1, published 1 Oct 2026) - [CVE-2026-103282: Ghost race condition in staff invitation acceptance mechanism](https://junglewise.ai/threats/cve-2026-103282-ghost-versions-0-5-0-before-6-23-0-contain-a-concurrency-issue) (medium, CVSS 4.3, published 1 Oct 2026) - [CVE-2026-103280: Ghost information disclosure in setup endpoint](https://junglewise.ai/threats/cve-2026-103280-ghost-from-version-0-8-0-before-6-23-0-contains-an-information) (medium, CVSS 5.3, published 1 Oct 2026) - [CVE-2026-103279: Ghost session invalidation bypass on password change](https://junglewise.ai/threats/cve-2026-103279-ghost-versions-from-3-10-0-before-6-34-0-fail-to-fully) (medium, CVSS 6.8, published 1 Oct 2026) - [CVE-2026-103278: Ghost input validation in admin iframe allows staff account takeover](https://junglewise.ai/threats/cve-2026-103278-ghost-versions-5-8-0-before-6-34-0-contain-an-input-validation) (high, CVSS 7.3, published 1 Oct 2026) - [CVE-2026-103277: Ghost oEmbed preview script injection vulnerability](https://junglewise.ai/threats/cve-2026-103277-ghost-versions-from-2-5-0-before-6-34-0-contain-an-untrusted) (high, CVSS 8.1, published 1 Oct 2026) - [CVE-2026-103276: Ghost file extension filtering bypass in theme serving](https://junglewise.ai/threats/cve-2026-103276-ghost-versions-before-6-20-0-contain-a-file-extension-filtering) (medium, CVSS 5.3, published 1 Oct 2026) - [CVE-2026-103275: Ghost information disclosure in Admin API bulk endpoints](https://junglewise.ai/threats/cve-2026-103275-ghost-5-42-2-before-6-58-0-contains-an-information-disclosure) (medium, CVSS 4.3, published 1 Oct 2026) - [CVE-2026-103273: Ghost staff token authorization bypass in post editing](https://junglewise.ai/threats/cve-2026-103273-ghost-versions-4-3-0-before-6-58-0-contain-an-authentication) (medium, CVSS 4.3, published 1 Oct 2026) ## Most severe TryGhost vulnerabilities - [CVE-2026-105642: Ghost remote code execution via bookmark card images](https://junglewise.ai/threats/cve-2026-105642-ghost-is-a-node-js-content-management-system-from-6-56-0-until-6) (high, CVSS 8.8, published 5 Oct 2026) - [CVE-2026-103283: Ghost session handling authentication bypass via user impersonation](https://junglewise.ai/threats/cve-2026-103283-ghost-versions-6-20-0-before-6-57-1-contain-a-session-handling) (high, CVSS 8.1, published 1 Oct 2026) - [CVE-2026-103277: Ghost oEmbed preview script injection vulnerability](https://junglewise.ai/threats/cve-2026-103277-ghost-versions-from-2-5-0-before-6-34-0-contain-an-untrusted) (high, CVSS 8.1, published 1 Oct 2026) - [CVE-2026-103292: Ghost JSON-LD cross-site scripting in ghost_head helper](https://junglewise.ai/threats/cve-2026-103292-ghost-versions-from-0-5-3-through-versions-prior-to-6-50-0-fail) (high, CVSS 8, published 1 Oct 2026) - [CVE-2026-103272: Ghost staff enumeration vulnerability in content API](https://junglewise.ai/threats/cve-2026-103272-ghost-versions-from-2-10-0-before-6-63-0-contain-a-staff) (high, CVSS 7.5, published 1 Oct 2026) - [CVE-2026-104416: Ghost information disclosure in Admin API invite tokens](https://junglewise.ai/threats/cve-2026-104416-ghost-from-4-39-0-before-6-64-0-contains-an-information) (high, CVSS 7.5, published 2 Oct 2026) - [CVE-2026-103278: Ghost input validation in admin iframe allows staff account takeover](https://junglewise.ai/threats/cve-2026-103278-ghost-versions-5-8-0-before-6-34-0-contain-an-input-validation) (high, CVSS 7.3, published 1 Oct 2026) - [CVE-2026-105679: Ghost content type validation bypass in local file storage](https://junglewise.ai/threats/cve-2026-105679-ghost-is-a-node-js-content-management-system-from-6-22-1-until-6) (high, CVSS 7.3, published 5 Oct 2026) - [CVE-2026-104418: Ghost remote code execution via theme translation files](https://junglewise.ai/threats/cve-2026-104418-ghost-from-6-10-3-before-6-64-0-contains-a-remote-code-execution) (high, CVSS 7.2, published 2 Oct 2026) - [CVE-2026-105644: Ghost stored cross-site scripting in SVG image imports](https://junglewise.ai/threats/cve-2026-105644-ghost-is-a-node-js-content-management-system-from-4-0-0-until-6) (medium, CVSS 6.8, published 5 Oct 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 27 vulnerabilities in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 21 | 0 | 0 | | 5 Oct 2026 | 6 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## TryGhost technologies - [TryGhost Ghost](https://junglewise.ai/threats/technologies/tryghost-ghost): 28 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "TryGhost vulnerabilities", https://junglewise.ai/threats/vendors/tryghost, 9 November 2026.