Vendor

    TryGhost

    88 known vulnerabilities in products by TryGhost, 0 of them actively exploited (CISA KEV).

    Key figures

    88

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    3

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in TryGhost
    CriticalCVE-2026-26980

    Ghost has a SQL Injection in its Content API

    also in 1 other product

    		9.4
    CriticalCVE-2026-29053

    Ghost Vulnerable to Remote Code Execution via Malicious Themes

    also in 1 other product

    		7.7
    HighCVE-2023-31133

    Ghost vulnerable to disclosure of private API fields

    also in 1 other product

    		7.5
    MediumCVE-2023-40028

    Arbitrary file read via symlinks in Ghost

    also in 1 other product

    		4.9
    MediumCVE-2021-29484

    DOM XSS in Theme Preview

    also in 1 other product

    		6.8
    HighCVE-2026-22594

    Ghost has Staff 2FA bypass

    also in 1 other product

    		8.1
    HighCVE-2026-104418

    Ghost from 6.10.3 before 6.64.0 RCE via Theme Translation Files

    		7.2
    HighCVE-2026-105677

    Ghost: Remote Code Execution via Theme Translation Files

    		7.2
    HighCVE-2026-103271

    Ghost 4.0.0 before 6.63.0 Restricted Content Bypass

    		7.5
    CriticalCVE-2026-53943

    Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header

    		9.6
    HighCVE-2026-103272

    Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content API

    		7.5
    HighCVE-2026-103268

    Ghost 1.0.0 before 6.62.0 Suspension Bypass via Password Reset

    		8.8
    HighCVE-2026-105642

    Ghost: Remote Code Execution via Bookmark Card Images

    		8.8
    HighCVE-2026-105675

    Ghost: Invite Token Disclosure in Ghost Admin API

    		7.5
    HighCVE-2026-105650

    Ghost: Stored XSS via oEmbed Photo Responses

    		8.1
    HighCVE-2026-104414

    Ghost from 2.5.0 before 6.64.0 Stored XSS via oEmbed Photo Responses

    		8.1
    HighCVE-2026-103277

    Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed

    		8.1
    HighCVE-2026-103283

    Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling

    		8.1
    HighCVE-2026-103278

    Ghost 5.8.0 before 6.34.0 Staff Account Takeover via Admin iframe

    		7.3
    HighCVE-2026-104413

    Ghost 5.94.0 before 6.64.0 Stored XSS via Bookmark Card Images

    		7.3
    HighCVE-2026-104411

    Ghost 6.22.1 before 6.64.0 Stored XSS via Local Storage File Uploads

    		7.3
    HighCVE-2026-103292

    Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_head

    		8.0
    HighCVE-2026-104416

    Ghost 4.39.0 before 6.64.0 Invite Token Disclosure via Admin API

    		7.5
    HighCVE-2026-103286

    Ghost 2.21.0 before 6.56.0 Privilege Escalation via Notifications

    		7.3
    HighCVE-2026-22595

    Ghost has Staff Token permission bypass

    also in 1 other product

    		8.1

    All vulnerabilities in search

    News

    Products

    Products by TryGhost
    TryGhost Ghost850