TryGhost · product
Ghost
85 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
- check available
- 2
- likely to be exploited
- 2
Every one of the 85 is a mark on the map. Named now: 1 to 26, most at risk first.
- Ghost CMS Content API - SQL Injection
- Ghost CMS <=4.32 - Cross-Site Scripting
- Arbitrary file read via symlinks in Ghost
- Ghost vulnerable to disclosure of private API fields
- Ghost Vulnerable to Remote Code Execution via Malicious Themes
- Ghost has Staff 2FA bypass
- Privilege escalation: all users can access Admin-level API keys
- Ghost from 6.10.3 before 6.64.0 RCE via Theme Translation Files
- Ghost has Staff Token permission bypass
- Ghost: Remote Code Execution via Theme Translation Files
- Ghost has SQL Injection in Members Activity Feed
- Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header
- Ghost: Database Backup Path Traversal
- Ghost: Cross-Site Scripting in Universal Import
- Ghost: Theme Upload Path Traversal
- Ghost: Paid gift memberships obtainable at minimal cost via the donations feature
- Ghost: Path Traversal via Locale Setting
- Ghost: Invite Token Disclosure in Ghost Admin API
- Ghost 4.0.0 before 6.63.0 Restricted Content Bypass
- Ghost: Server-Side Request Forgery in Image Fetching
- Ghost 1.20.0 before 6.64.0 Path Traversal via Locale Setting
- Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content API
- Ghost Content API filter bypass reveals private fields
- @tryghost/activitypub: XSS in Ghost's ActivityPub client
- Ghost: Regular Expression Denial of Service in Content Import
- Ghost: Regular Expression Denial of Service in External Media Inliner
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.