Feed live

ghost CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

347,132

All time

Critical · Active

11,967

CVSS ≥ 9.0

New · 14 days

2,669

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 1–30 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-70596	medium	4.3/10	Ghost: Cross-Site Scripting in Feature Image Captions	Aug 5, 2026 18d ago
CVE-2026-70595	medium	4.0/10	Ghost: Server-Side Request Forgery Mitigation Issue	Aug 5, 2026 18d ago
CVE-2026-70590	medium	4.8/10	Ghost: Blind Password Hash Disclosure in Ghost Admin API	Aug 4, 2026 19d ago
CVE-2026-70589	medium	4.8/10	Ghost: Archived Offers can be Redeemed	Aug 4, 2026 19d ago
CVE-2026-59817	medium	5.3/10	Ghost: Paid gift memberships obtainable at minimal cost via the donations feature	Jul 9, 2026 1mo ago
CVE-2026-59708	high	8.7/10	Ghostfolio - Unauthorized Portfolio Data Exposure via Public Endpoint	Jul 7, 2026 1mo ago
CVE-2026-59709	medium	5.3/10	Ghostfolio - Unauthorized Portfolio Holding Tag Modification via Missing Permission Check	Jul 7, 2026 1mo ago
CVE-2026-46656	high	8.8/10	Bludit CMS has improper authorization and mediation failure leading to persistent ghost sessions	Jun 8, 2026 2mo ago
CVE-2026-40622	medium	6.6/10	Another 'ghost domain names' attack variant	May 20, 2026 3mo ago
CVE-2026-39484	medium	4.7/10	WordPress Hide My WP Ghost plugin < 7.0.00 - Open Redirection vulnerability	Apr 8, 2026 4mo ago
CVE-2026-26982	medium	6.3/10	Ghostty affected by arbitrary command execution via control characters in paste and drag-and-drop operations	Mar 9, 2026 5mo ago
CVE-2026-29784	high	7.5/10	Ghost: Incomplete CSRF protections around OTC use	Mar 7, 2026 5mo ago
CVE-2026-28785	critical	9.3/10	Ghostfolio: Time-Based Blind SQL Injection in Manual Asset Import	Mar 6, 2026 5mo ago
CVE-2026-28680	critical	9.3/10	Ghostfolio: Full-Read SSRF in Manual Asset Import	Mar 6, 2026 5mo ago
CVE-2026-29053	high	7.7/10	Ghost Vulnerable to Remote Code Execution via Malicious Themes	Mar 5, 2026 5mo ago
CVE-2026-26980	critical	9.4/10	Ghost has a SQL Injection in its Content API	Feb 20, 2026 6mo ago
CVE-2026-24778	high	8.8/10	Ghost vulnerable to XSS via malicious Portal preview links	Jan 27, 2026 6mo ago
CVE-2021-47752	high	8.7/10	AWebServer GhostBuilding 18 - Denial of Service (DoS)	Jan 15, 2026 7mo ago
CVE-2025-15020	medium	6.5/10	Gotham Block Extra Light <= 1.5.0 - Authenticated (Contributor+) Arbitrary File Read via 'ghostban' Shortcode	Jan 14, 2026 7mo ago
CVE-2026-22597	medium	5.1/10	Ghost has SSRF via External Media Inliner	Jan 10, 2026 7mo ago
CVE-2026-22596	medium	6.7/10	Ghost has SQL Injection in Members Activity Feed	Jan 10, 2026 7mo ago
CVE-2026-22595	high	8.1/10	Ghost has Staff Token permission bypass	Jan 10, 2026 7mo ago
CVE-2026-22594	high	8.1/10	Ghost has Staff 2FA bypass	Jan 10, 2026 7mo ago
CVE-2025-12342	medium	6.9/10	Serdar Bayram Ghost Hot Spot Login Auth.php sql injection	Oct 28, 2025 10mo ago
CVE-2025-41110	high	7.0/10	Improper Authentication vulnerability in Ghost Robotics' Vision 60	Oct 22, 2025 10mo ago
CVE-2025-41109	high	8.7/10	Use of Hard-coded Credentials vulnerability in Ghost Robotics' Vision 60	Oct 22, 2025 10mo ago
CVE-2025-41108	critical	9.2/10	Improper Authentication vulnerability in Ghost Robotics' Vision 60	Oct 22, 2025 10mo ago
CVE-2025-9992	medium	6.4/10	Ghost Kit <= 3.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting	Sep 18, 2025 11mo ago
CVE-2025-9862	medium	6.1/10	Ghost 6.0.6 - SSRF via oEmbed Bookmark	Sep 17, 2025 11mo ago
CVE-2025-53567	high	8.1/10	WordPress Ghost Kit <= 3.4.1 - Local File Inclusion Vulnerability	Aug 20, 2025 1y ago