TryGhost vulnerabilities

CVEs per yearBy the year they were published

1. 20213
2. 20232
3. 20241
4. 202682

Newest CVEs

• CVE-2026-63115

  ActivityPub Undo handler can unfollow or remove reposts on behalf of other accounts

  TryGhost · ActivityPub

  Medium5.3
• CVE-2026-105683

  Ghost: Path Traversal Vulnerability in Ghost ImageSize Service

  TryGhost · Ghost

  Low3.8
• CVE-2026-105682

  Ghost: Server-Side Request Forgery in Webhook Trigger

  TryGhost · Ghost

  Low2.7
• CVE-2026-105681

  Ghost: Authorization Bypass in Comments Feature

  TryGhost · Ghost

  Medium6.5
• CVE-2026-105680

  Ghost: Authorization Issue Allowed Author Role to Delete any Post

  TryGhost · Ghost

  Medium6.5
• CVE-2026-105679

  Ghost: Stored XSS via File Uploads on Local Storage

  TryGhost · Ghost

  High7.3
• CVE-2026-105678

  Ghost: Editors Could Promote Staff Users to Their Own Role

  TryGhost · Ghost

  Medium4.3
• CVE-2026-105677

  Ghost: Remote Code Execution via Theme Translation Files

  TryGhost · Ghost

  High7.2
• CVE-2026-105676

  Ghost: Path Traversal via Locale Setting

  TryGhost · Ghost

  Medium4.9
• CVE-2026-105675

  Ghost: Invite Token Disclosure in Ghost Admin API

  TryGhost · Ghost

  High7.5