CVE-2026-103289

The Ghost content management system, specifically versions 5.9.0 before 6.44.1 , is vulnerable to an authorization bypass within its comments feature . An input validation issue allows authenticated members to access and view restricted comment data for which they lack proper authorization. No sp...

CVE-2026-103289 Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments

Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access comments they are not authorized to view, resulting in disclosure of restricted comment data...

CVE-2026-103289 Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments

Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access comments they are not authorized to view, resulting in disclosure of restricted comment data...

CVE-2026-103288 Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like

Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An authenticated member can delete comment likes or dislikes belonging to other users that they are not authorized to delete, resulting in an authorizatio...

CVE-2026-103288 Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like

Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An authenticated member can delete comment likes or dislikes belonging to other users that they are not authorized to delete, resulting in an authorizatio...

CVE-2026-103288

The open-source publishing platform Ghost contains an input validation flaw within its comment like feature in versions 5.9.0 before 6.44.1 . This vulnerability allows an authenticated member to bypass authorization controls to delete comment likes or dislikes belonging to other users. Successful...

EUVD-2026-90681

Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An authenticated member can delete comment likes or dislikes belonging to other users that they are not authorized to delete, resulting in an authorizatio...

CVE-2026-103288 Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like

Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An authenticated member can delete comment likes or dislikes belonging to other users that they are not authorized to delete, resulting in an authorizatio...

CVE-2026-103274 Ghost 5.3.0 before 6.58.0 Unauthenticated Comment Read

Ghost versions 5.3.0 before 6.58.0 fail to properly enforce access controls on comments in private mode. Unauthenticated visitors can read comments that should be restricted, bypassing privacy settings...

CVE-2026-103274 Ghost 5.3.0 before 6.58.0 Unauthenticated Comment Read

Ghost versions 5.3.0 before 6.58.0 fail to properly enforce access controls on comments in private mode. Unauthenticated visitors can read comments that should be restricted, bypassing privacy settings...

CVE-2026-103274 Ghost 5.3.0 before 6.58.0 Unauthenticated Comment Read

Ghost versions 5.3.0 before 6.58.0 fail to properly enforce access controls on comments in private mode. Unauthenticated visitors can read comments that should be restricted, bypassing privacy settings...

CVE-2026-103274

Ghost versions 5.3.0 before 6.58.0 are vulnerable to an unauthenticated comment read vulnerability. The application fails to properly enforce access controls on comments when the site is in private mode , allowing unauthenticated visitors to read restricted comments and bypass intended privacy se...

EUVD-2026-90437

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that fails to escape roomnum, floor, and comment field values in input attributes. Attackers can induce authenticated back-office users to submit crafted POST requests with malicious...

PT-2026-104010

Name of the Vulnerable Software and Affected Versions stream-json versions prior to 3.6.0 Description The JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash when a block or line comment spans an inpu...

CVE-2026-103288: Authorization Bypass Through User-Controlled Key

Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An authenticated member can delete comment likes or dislikes belonging to other users that they are not authorized to delete, resulting in an authorizatio...

PT-2026-103820

Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An authenticated member can delete comment likes or dislikes belonging to other users that they are not authorized to delete, resulting in an authorizatio...

CVE-2026-103589

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that fails to escape roomnum, floor, and comment field values in input attributes. Attackers can induce authenticated back-office users to submit crafted POST requests with malicious...

CVE-2026-103589 QloApps through 1.7.0 Reflected XSS via Room Type Editor

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that fails to escape roomnum, floor, and comment field values in input attributes. Attackers can induce authenticated back-office users to submit crafted POST requests with malicious...

CVE-2026-103589 QloApps through 1.7.0 Reflected XSS via Room Type Editor

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that fails to escape roomnum, floor, and comment field values in input attributes. Attackers can induce authenticated back-office users to submit crafted POST requests with malicious...

CVE-2026-103589 QloApps through 1.7.0 Reflected XSS via Room Type Editor

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that fails to escape roomnum, floor, and comment field values in input attributes. Attackers can induce authenticated back-office users to submit crafted POST requests with malicious...