CVE-2026-103272

Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauthenticated attackers to leak user data. Attackers can observe discrepancies in API metadata responses to enumerate staff members and extract sensitive information without...

CVE-2026-103272 Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content API

Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauthenticated attackers to leak user data. Attackers can observe discrepancies in API metadata responses to enumerate staff members and extract sensitive information without...

EUVD-2026-90665

Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauthenticated attackers to leak user data. Attackers can observe discrepancies in API metadata responses to enumerate staff members and extract sensitive information without...

CVE-2026-103271 Ghost 4.0.0 before 6.63.0 Restricted Content Bypass

Ghost versions from 4.0.0 before 6.63.0 contain a content API vulnerability that allows unauthenticated visitors to access gated post content. Attackers can bypass content restrictions by directly querying the content API to retrieve restricted posts without authentication...

CVE-2026-103271 Ghost 4.0.0 before 6.63.0 Restricted Content Bypass

Ghost versions from 4.0.0 before 6.63.0 contain a content API vulnerability that allows unauthenticated visitors to access gated post content. Attackers can bypass content restrictions by directly querying the content API to retrieve restricted posts without authentication...

CVE-2026-103271

Ghost versions from 4.0.0 before 6.63.0 are vulnerable to a content API vulnerability that enables unauthenticated visitors to bypass content restrictions. Attackers can directly query the content API to retrieve gated post content without providing any authentication. No specific exploit details...

CVE-2026-103271 Ghost 4.0.0 before 6.63.0 Restricted Content Bypass

Ghost versions from 4.0.0 before 6.63.0 contain a content API vulnerability that allows unauthenticated visitors to access gated post content. Attackers can bypass content restrictions by directly querying the content API to retrieve restricted posts without authentication...

EUVD-2026-90664

Ghost versions from 4.0.0 before 6.63.0 contain a content API vulnerability that allows unauthenticated visitors to access gated post content. Attackers can bypass content restrictions by directly querying the content API to retrieve restricted posts without authentication...

CVE-2026-103269 Ghost 5.3.0 before 6.62.0 Missing Authorization via Post Excerpts

Ghost versions 5.3.0 before 6.62.0 contain a missing authorization vulnerability that allows an authenticated site member to read the excerpts of posts they do not have access to gated content...

EUVD-2026-90663

Ghost versions 5.3.0 before 6.62.0 contain a missing authorization vulnerability that allows an authenticated site member to read the excerpts of posts they do not have access to gated content...

CVE-2026-103269 Ghost 5.3.0 before 6.62.0 Missing Authorization via Post Excerpts

Ghost versions 5.3.0 before 6.62.0 contain a missing authorization vulnerability that allows an authenticated site member to read the excerpts of posts they do not have access to gated content...

CVE-2026-103493

In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible...

EUVD-2026-90590

A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication or encryption instead of restricting access to the local system. An unauthenticated attacker on an adjacent network can connect to the exposed servi...

CVE-2026-103493

In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible...

CLEANSTART-2024-UW64833 Insufficient policy enforcement in content security policy in Google Chrome prior to 91

Security vulnerability affects the chromium package. Insufficient policy enforcement in content security policy in Google Chrome prior to 91...

CLEANSTART-2024-AK74596 Insufficient policy enforcement in content security policy in Google Chrome prior to 91

Security vulnerability affects the chromium package. Insufficient policy enforcement in content security policy in Google Chrome prior to 91...

CLEANSTART-2024-IZ73327 Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 91

Security vulnerability affects the chromium package. Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 91...

CLEANSTART-2024-MU24311 Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 91

Security vulnerability affects the chromium package. Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 91...

CLEANSTART-2026-GO32360 CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute

Security vulnerability affects the cri-tools package. CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute...

CVE-2026-87973

The If-So Dynamic Content WordPress plugin before 1.10.2 does not sanitize a conversion name before storing it, nor escape it when rendering the analytics page, allowing users with editor-level access to store JavaScript that executes in the session of a higher-privileged user who views that page...