EUVD-2026-92636

Ghost: Regular Expression Denial of Service in Content Import...

GHSA-FWH9-QG68-VXP4 Ghost: Regular Expression Denial of Service in Content Import

Impact A crafted content import file could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. Vulnerable versions This vulnerability is present in Ghost from v4.0.0 up to v6.65.0. Patches v6.67.0 contains a fix for this issue. How to...

Ghost: Regular Expression Denial of Service in Content Import

Impact A crafted content import file could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. Vulnerable versions This vulnerability is present in Ghost from v4.0.0 up to v6.65.0. Patches v6.67.0 contains a fix for this issue. How to...

NPM: Ghost: Regular Expression Denial of Service in Content Import

NPM: Ghost: Regular Expression Denial of Service in Content Import vulnerability discovered by ? in WordPress Npm ghost versions = 4.0.0, 6.67.0...

CVE-2026-105646

Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, a crafted content import file could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0...

CVE-2026-105646 Ghost: Regular Expression Denial of Service in Content Import

Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, a crafted content import file could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0...

CVE-2026-105646

The Ghost Node.js content management system is vulnerable to a Regular Expression Denial of Service (ReDoS) in its content import functionality. Specifically, versions 4.0.0 through 6.67.0 allow a crafted content import file to cause excessive CPU usage , potentially rendering the server unrespon...

CVE-2026-105646 Ghost: Regular Expression Denial of Service in Content Import

Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, a crafted content import file could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0...

CVE-2026-105646 Ghost: Regular Expression Denial of Service in Content Import

Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, a crafted content import file could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0...

PT-2026-106180

Name of the Vulnerable Software and Affected Versions Ghost versions 4.0.0 through 6.66.0 Description A crafted content import file can lead to excessive CPU usage, resulting in the Ghost server becoming unresponsive. This issue requires Administrator access to be exploited. Recommendations Updat...

CVE-2026-105646: Inefficient Regular Expression Complexity

Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, a crafted content import file could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0...

CVE-2026-92424

The Content Egg WordPress plugin before 11.9.0 does not verify that a user running its bulk content-import feature is authorized for the import preset they select, and switches to the preset author's identity before creating the resulting post, allowing users with contributor-level access and abo...

CVE-2026-92424 Content Egg < 11.9.0 - Contributor+ Stored XSS via Import Queue

The Content Egg WordPress plugin before 11.9.0 does not verify that a user running its bulk content-import feature is authorized for the import preset they select, and switches to the preset author's identity before creating the resulting post, allowing users with contributor-level access and abo...

CVE-2026-92424

The Content Egg WordPress plugin (versions prior to 11.9.0 ) is vulnerable to a stored Cross-Site Scripting (XSS) flaw. The issue arises because the bulk content-import feature fails to verify if a user is authorized to use a selected import preset; instead, it switches to the preset author's ide...

EUVD-2026-89621

The Content Egg WordPress plugin before 11.9.0 does not verify that a user running its bulk content-import feature is authorized for the import preset they select, and switches to the preset author's identity before creating the resulting post, allowing users with contributor-level access and abo...

CVE-2026-92424 Content Egg < 11.9.0 - Contributor+ Stored XSS via Import Queue

The Content Egg WordPress plugin before 11.9.0 does not verify that a user running its bulk content-import feature is authorized for the import preset they select, and switches to the preset author's identity before creating the resulting post, allowing users with contributor-level access and abo...

CVE-2026-92424: Improper Neutralization of Input During Web Page Generation

The Content Egg WordPress plugin before 11.9.0 does not verify that a user running its bulk content-import feature is authorized for the import preset they select, and switches to the preset author's identity before creating the resulting post, allowing users with contributor-level access and abo...

PT-2026-103042

The Content Egg WordPress plugin before 11.9.0 does not verify that a user running its bulk content-import feature is authorized for the import preset they select, and switches to the preset author's identity before creating the resulting post, allowing users with contributor-level access and abo...

CVE-2026-54166

Shelf is a platform for tracking physical assets. Prior to version 1.20.3, authenticated users with the asset:import permission can trigger server-side HTTP requests to attacker-controlled URLs through the Asset CSV Content Import feature. The imageUrl validation logic can be bypassed through...

CVE-2026-54166: Server-Side Request Forgery (SSRF)

Shelf is a platform for tracking physical assets. Prior to version 1.20.3, authenticated users with the asset:import permission can trigger server-side HTTP requests to attacker-controlled URLs through the Asset CSV Content Import feature. The imageUrl validation logic can be bypassed through...