Security advisories

medium2026-08-05

CVE-2026-53949-Ghost Content API filter bypass reveals private fields

tryghost/ghost · GHSA-jx35-x7fj-vgpr

medium2026-08-05

CVE-2026-70596-Ghost: Cross-Site Scripting in Feature Image Captions

tryghost/ghost · GHSA-pr22-p9rp-2cqv

medium2026-08-05

CVE-2026-70595-Ghost: Server-Side Request Forgery Mitigation Issue

tryghost/ghost · GHSA-x5mm-wm4g-j5xv

high2026-08-05

CVE-2026-71211- MLflow AI Gateway permits SSRF through an unvalidated api_base

mlflow/mlflow · GHSA-h7x2-h6g9-p789

medium2026-08-04

CVE-2026-59817-Ghost: Paid gift memberships obtainable at minimal cost via the donations feature

tryghost/ghost · GHSA-xm43-3m56-w3wf

medium2026-08-04

CVE-2026-53947-Ghost: Member existence leak via magic link sign-in response

tryghost/ghost · GHSA-chgm-3698-jm42

high2026-08-04

CVE-2026-53950-XSS in Ghost's ActivityPub client

tryghost/ghost · GHSA-xpp7-93x6-v29m

medium2026-08-04

CVE-2026-70594-Ghost: Session Fixation in Ghost Admin

tryghost/ghost · GHSA-7mpp-r37j-x5wh

medium2026-08-04

CVE-2026-70593-Ghost: Theme Upload Path Traversal

tryghost/ghost · GHSA-cjc9-q5gf-327p

medium2026-08-04

CVE-2026-70592-Ghost: Database Backup Path Traversal

tryghost/ghost · GHSA-cj62-hvv2-2q5h

medium2026-08-04

CVE-2026-70591-Ghost: Server-Side Request Forgery in Image Fetching

tryghost/ghost · GHSA-gcvv-72q8-9v76

medium2026-08-04

CVE-2026-70590-Ghost: Blind Password Hash Disclosure in Ghost Admin API

tryghost/ghost · GHSA-jm22-3w23-5q7w

medium2026-08-04

CVE-2026-53946-Ghost: Mobiledoc image-size fetch SSRF

tryghost/ghost · GHSA-g366-23fw-ggp6

medium2026-08-04

CVE-2026-53945-Ghost: Server-side request forgery via DNS rebinding in external request handling

tryghost/ghost · GHSA-ch52-px8q-f22j

medium2026-08-04

CVE-2026-53944-Ghost: Private IP filtering bypass to make server-side requests to internal services

tryghost/ghost · GHSA-wvp2-4qqp-4h3r

medium2026-08-04

CVE-2026-70589-Ghost: Archived Offers can be Redeemed

tryghost/ghost · GHSA-4wx2-7gvj-qfq3

medium2026-08-04

CVE-2026-53948-Ghost: File Upload Content-Type Spoofing

tryghost/ghost · GHSA-944x-pm95-3jpr

medium2026-08-04

CVE-2026-70588-Ghost: Cross-Site Scripting in Universal Import

tryghost/ghost · GHSA-2gx6-7gx2-wwcf

high2026-08-04

CVE-2026-70494-Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder

open-webui/open-webui · GHSA-3cg5-48j3-v4gv

medium2026-08-04

CVE-2026-70493-Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically

open-webui/open-webui · GHSA-2f54-p244-32q6