Ghost

This hub aggregates every CVE we track for Ghost, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Ghost.

• CVE-2026-53943Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header9.6Jun 24, 2026
• CVE-2026-53944Ghost: Private IP filtering bypass to make server-side requests to internal services5.8Jun 24, 2026
• CVE-2026-53945Ghost: Server-side request forgery via DNS rebinding in external request handling4.0Jun 24, 2026
• CVE-2026-53946Ghost: Mobiledoc image-size fetch SSRF5.4Jun 24, 2026
• CVE-2026-53947Ghost: Member existence leak via magic link sign-in response5.3Jun 24, 2026
• CVE-2026-53948Ghost: File Upload Content-Type Spoofing5.4Jun 24, 2026
• CVE-2026-53949Ghost Content API filter bypass reveals private fields5.3Jun 24, 2026
• CVE-2026-53950@tryghost/activitypub: XSS in Ghost's ActivityPub client7.5Jun 24, 2026
• CVE-2026-29784Ghost: Incomplete CSRF protections around OTC use7.5Mar 7, 2026
• CVE-2026-29053Ghost Vulnerable to Remote Code Execution via Malicious Themes7.6Mar 5, 2026
• CVE-2026-26365Akamai Ghost on Akamai CDN edge servers before 2026-02-06 mishandles processing of custom hop-by-hop HTTP headers, where an incoming request containing the header "Connection: Transfer-Encoding" co...4.0Feb 23, 2026
• CVE-2026-26980Ghost has a SQL Injection in its Content API9.4Feb 20, 2026
• CVE-2026-24778Ghost vulnerable to XSS via malicious Portal preview links8.8Jan 27, 2026
• CVE-2026-22597Ghost has SSRF via External Media Inliner2.7Jan 10, 2026
• CVE-2026-22596Ghost has SQL Injection in Members Activity Feed6.7Jan 10, 2026