Exposure of Ghost

Blogs, CMS
84
exposure score
2,983
sites use
0
exploited
7
critical
Vexday analysis

O Ghost acumula 31 CVEs catalogadas, das quais nenhuma consta no catálogo KEV da CISA, posicionando a tecnologia abaixo da média geral do catálogo em termos de exploração ativa confirmada. Ainda assim, o volume de 8 vulnerabilidades surgidas nos últimos 90 dias e a existência de 7 de severidade crítica indicam uma superfície de ataque em expansão que merece acompanhamento contínuo. O tipo de falha mais recorrente é CWE-918 (Server-Side Request Forgery), o que sugere fragilidades na forma como a aplicação realiza requisições externas — uma classe de vulnerabilidade frequentemente encadeada em ataques mais complexos. A CVE mais preocupante no momento é CVE-2026-26980, com pontuação EPSS de aproximadamente 0,70, sinalizando probabilidade relevante de exploração em curto prazo e justificando priorização imediata nas rotinas de patching.

CVEs

42 results
CVE-2026-53949MEDIUMGhost Content API filter bypass reveals private fieldsEPSS 0.4%CVE-2026-53950HIGH@tryghost/activitypub: XSS in Ghost's ActivityPub clientEPSS 0.4%CVE-2026-53947MEDIUMGhost: Member existence leak via magic link sign-in responseEPSS 0.3%CVE-2026-53944MEDIUMGhost: Private IP filtering bypass to make server-side requests to internal servicesEPSS 0.3%CVE-2024-43409MEDIUMGhost's improper authentication allows access to member information and actionsEPSS 0.3%CVE-2026-22597MEDIUMGhost has SSRF via External Media InlinerEPSS 0.3%CVE-2026-70592MEDIUMGhost: Database Backup Path TraversalEPSS 0.3%CVE-2026-70593MEDIUMGhost: Theme Upload Path TraversalEPSS 0.3%CVE-2026-24778HIGHGhost vulnerable to XSS via malicious Portal preview linksEPSS 0.3%CVE-2026-70588MEDIUMGhost: Cross-Site Scripting in Universal ImportEPSS 0.3%CVE-2026-53948MEDIUMGhost: File Upload Content-Type SpoofingEPSS 0.2%CVE-2026-70591MEDIUMGhost: Server-Side Request Forgery in Image FetchingEPSS 0.2%CVE-2026-53945MEDIUMGhost: Server-side request forgery via DNS rebinding in external request handlingEPSS 0.2%CVE-2026-72596HIGHGhost Foundation Ghost - Broken Access ControlEPSS 0.2%CVE-2026-53946MEDIUMGhost: Mobiledoc image-size fetch SSRFEPSS 0.2%CVE-2026-70590MEDIUMGhost: Blind Password Hash Disclosure in Ghost Admin APIEPSS 0.2%CVE-2026-70596MEDIUMGhost: Cross-Site Scripting in Feature Image CaptionsEPSS 0.2%CVE-2026-26365MEDIUMAkamai Ghost on Akamai CDN edge servers before 2026-02-06 mishandles processing of custom hop-by-hop HTTP headers, where an incoming requestEPSS 0.2%CVE-2026-70595MEDIUMGhost: Server-Side Request Forgery Mitigation IssueEPSS 0.2%CVE-2026-70589MEDIUMGhost: Archived Offers can be RedeemedEPSS 0.2%