PT-2026-104227

Name of the Vulnerable Software and Affected Versions Ghost versions 4.39.0 through 6.63.x Description An information disclosure issue exists in the Admin API that allows staff users to view secret tokens associated with pending staff invites. Staff users who possess invite viewing permissions ca...

PT-2026-104226

Name of the Vulnerable Software and Affected Versions Ghost versions 0.7.2 through 6.63.0 Description An information disclosure issue exists in the Admin API that allows authenticated staff-level users to determine the relative ordering of password hashes belonging to other staff users. This is...

PT-2026-104229

Name of the Vulnerable Software and Affected Versions Ghost versions 6.10.3 through 6.63.x Description Authenticated administrators can achieve remote code execution by abusing the theme translation file loading process. This occurs when an attacker with administrator privileges uploads a special...

PT-2026-104225

Name of the Vulnerable Software and Affected Versions Ghost versions 2.5.0 through 6.63.0 Description A stored cross-site scripting issue exists where untrusted scripts can be injected into post content through oEmbed photo responses. An attacker can host a malicious oEmbed photo response; when t...

PT-2026-104223

Name of the Vulnerable Software and Affected Versions Ghost versions 0.5.0 through 6.63.x Description Ghost fails to correctly restrict staff role assignment. This allows authenticated users with the Editor or Super Editor role to assign their own role to other staff members, even though they lac...

cookbook-update-glibc

cookbook-update-glibc Overview cookbook for update glibc. CVE-2015-0235GHOST Japan http://www.walbrix.com/jp/blog/2015-01-ghost.html English http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0235 Description update glibc by Chef Solo. Attention. this cookbook need to reboot. Platform is...

CVE-2026-29053

CVE-2026-29053 RCE в Ghost CMS через цепочку прототипов jsonpath/static-eval. Информация CVE : CVE-2026-29053 Затронутые версии : Ghost -p 1. Запустите слушатель: nc -lvnp 2. Загрузите malicious-theme.zip в Ghost Admin → Settings → Design 3. Создайте страницу со слагом rce 4. Перейдите на /rce/...

ghost-cve-2026-26980

CVE-2026-26980 — Ghost CMS Content API SQL Injection Lab Unauthenticated blind SQL injection in Ghost CMS via the Content API's slug filter ordering mechanism, allowing arbitrary database reads from any Ghost instance without credentials. | ---|--- CVE| CVE-2026-26980 Advisory| GHSA-w52v-v783-gw9...

CYBERDUDEBIVASH-5G-Core-Key-Rotation-Ghost-Admin-Auditor

CYBERDUDEBIVASH 5G Core Key Rotation & Ghost Admin Auditor v1.1 © 2026 CYBERDUDEBIVASH – All Rights Reserved Global Authority in Zero-Trust 5G & Private Network Security Bhubaneswar, Odisha, India Production-grade tool for detecting & remediating CVE-2026-0622 Ghost Admin privilege escalation &...

OpenStack Swift vulnerable to authenticated server-side request forgery

In OpenStack Swift before 2.37.2, proxy-server does not strip internal update headers X-Container-Host, X-Container-Device, X-Delete-At-Host, X-Delete-At-Device from client requests before forwarding them to object-servers. An authenticated user with write access can inject these headers to...

CVE-2026-29053

This is a rework of the Repo by rootxran for this same CVE - https://github.com/rootxran/CVE-2026-29053 During testing against specific Ghost CMS environments, the original theme payload triggered a Fatal Handlebars Error. The CMS failed to activate the malicious theme because it referenced a...

ghostlock-a17

GhostLock — CVE-2026-43499 on Samsung Galaxy A17 Full user-to-root exploit chain for CVE-2026-43499 "GhostLock" on the Samsung Galaxy A17 SM-A175F , running Android 16 / GKI 6.12. The chain starts from the public GhostLock primitives and ends with a usermode helper executing as: uid=0root gid=0ro...

ghostbusters15

Stories in Ready ghostbusters15 Playbooks 'Fix for CVE-2015-0235GHOST' running on Ansible...

CVE-2023-40028

CVE-2023-40028: Ghost CMS Symlink Exploitation PoC Overview This repository contains a Proof-of-Concept PoC script designed to demonstrate the exploitation of CVE-2023-40028 , a Local File Inclusion LFI vulnerability affecting Ghost CMS versions prior to 5.59.1. The vulnerability allows...

CVE-2023-40028

Доказательство концепции PoC для CVE-2023-40028 CVE-2023-40028 — это уязвимость в Ghost CMS, которая позволяет произвольное чтение файлов из-за некорректной обработки файлов. Данный PoC демонстрирует, как эксплойт работает в контролируемых условиях. Только в образовательных целях. Ссылка:...

CVE-2026-103291

Ghost versions from 3.20.2 before 6.51.0 contain a server-side request forgery vulnerability in image dimension refetching that allows authenticated staff users to trigger outbound HTTP requests to arbitrary URLs. Attackers can point image cards at attacker-controlled hosts or internal network...

CVE-2026-103288

Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An authenticated member can delete comment likes or dislikes belonging to other users that they are not authorized to delete, resulting in an authorizatio...

CVE-2026-103292

Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emitted by the ghosthead helper. An authenticated user with limited privileges can inject unescaped content that is rendered as script in the published page, potentially leading to...

CVE-2026-103287

Ghost versions 1.18.0 before 6.27.0 contain a server-side request forgery vulnerability in the webhooks feature that allows staff users to probe internal hosts. Attackers with staff privileges can craft webhook requests to access internal network resources from the Ghost server...

CVE-2026-103289

Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access comments they are not authorized to view, resulting in disclosure of restricted comment data...