Vulnerabilities in TryGhost
88 resultsCVE-2026-104417MEDIUMGhost 1.20.0 before 6.64.0 Path Traversal via Locale SettingEPSS 0.4%CVE-2026-70591MEDIUMGhost: Server-Side Request Forgery in Image FetchingEPSS 0.4%CVE-2026-103272HIGHGhost 2.10.0 before 6.63.0 Staff Enumeration via Content APIEPSS 0.4%CVE-2026-53949MEDIUMGhost Content API filter bypass reveals private fieldsEPSS 0.4%CVE-2026-53950HIGH@tryghost/activitypub: XSS in Ghost's ActivityPub clientEPSS 0.4%CVE-2026-105645MEDIUMGhost: Regular Expression Denial of Service in External Media InlinerEPSS 0.3%CVE-2026-105646MEDIUMGhost: Regular Expression Denial of Service in Content ImportEPSS 0.3%CVE-2026-53947MEDIUMGhost: Member existence leak via magic link sign-in responseEPSS 0.3%CVE-2026-53944MEDIUMGhost: Private IP filtering bypass to make server-side requests to internal servicesEPSS 0.3%CVE-2026-105650HIGHGhost: Stored XSS via oEmbed Photo ResponsesEPSS 0.3%CVE-2026-70590MEDIUMGhost: Blind Password Hash Disclosure in Ghost Admin APIEPSS 0.3%CVE-2024-43409MEDIUMGhost's improper authentication allows access to member information and actionsEPSS 0.3%CVE-2026-105644MEDIUMGhost: Stored XSS via SVG Files in Content ImportsEPSS 0.3%CVE-2026-70596MEDIUMGhost: Cross-Site Scripting in Feature Image CaptionsEPSS 0.3%CVE-2026-103268HIGHGhost 1.0.0 before 6.62.0 Suspension Bypass via Password ResetEPSS 0.3%CVE-2026-105683LOWGhost: Path Traversal Vulnerability in Ghost ImageSize ServiceEPSS 0.3%CVE-2026-104416HIGHGhost 4.39.0 before 6.64.0 Invite Token Disclosure via Admin APIEPSS 0.3%CVE-2026-105651HIGHGhost: Stored XSS via Bookmark Card ImagesEPSS 0.3%CVE-2026-105649HIGHGhost: Stored XSS via SVG Uploads Bypassing SanitizationEPSS 0.3%CVE-2026-103266HIGHGhost 5.2.0 before 6.62.0 Unauthenticated Stripe Checkout Account ModificationEPSS 0.3%