PT-2026-104225

Name of the Vulnerable Software and Affected Versions Ghost versions 2.5.0 through 6.63.0 Description A stored cross-site scripting issue exists where untrusted scripts can be injected into post content through oEmbed photo responses. An attacker can host a malicious oEmbed photo response; when t...

CVE-2026-55232

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's SSRF guard resolves a host with an IPv4-only function and never inspects IPv6, so any host that lacks an A record passes a private-range check. Editor oEmbed...

EUVD-2026-91039

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's SSRF guard resolves a host with an IPv4-only function and never inspects IPv6, so any host that lacks an A record passes a private-range check. Editor oEmbed...

CVE-2026-55232 Vvveb: Server-side request forgery in Vvveb via IPv6 bypass of validateUrl() in editor oEmbed proxy

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's SSRF guard resolves a host with an IPv4-only function and never inspects IPv6, so any host that lacks an A record passes a private-range check. Editor oEmbed...

CVE-2026-55232

The Vvveb CMS is vulnerable to a Server-Side Request Forgery (SSRF) (CWE-918) prior to version 1.0.8.6 . The root cause is an incomplete SSRF guard that uses an IPv4-only function , failing to inspect IPv6 addresses. Consequently, hosts lacking an A record bypass the private-range check. An authe...

CVE-2026-55232 Vvveb: Server-side request forgery in Vvveb via IPv6 bypass of validateUrl() in editor oEmbed proxy

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's SSRF guard resolves a host with an IPv4-only function and never inspects IPv6, so any host that lacks an A record passes a private-range check. Editor oEmbed...

CVE-2026-55232 Vvveb: Server-side request forgery in Vvveb via IPv6 bypass of validateUrl() in editor oEmbed proxy

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's SSRF guard resolves a host with an IPv4-only function and never inspects IPv6, so any host that lacks an A record passes a private-range check. Editor oEmbed...

CVE-2026-103277

Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview feature that fails to sandbox externally hosted scripts. Attackers can craft malicious oEmbed content to execute scripts in the context of a staff user's admin session, potentially...

CVE-2026-103277 Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed

Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview feature that fails to sandbox externally hosted scripts. Attackers can craft malicious oEmbed content to execute scripts in the context of a staff user's admin session, potentially...

CVE-2026-103277 Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed

Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview feature that fails to sandbox externally hosted scripts. Attackers can craft malicious oEmbed content to execute scripts in the context of a staff user's admin session, potentially...

CVE-2026-103277

Ghost versions from 2.5.0 before 6.34.0 are vulnerable to untrusted script execution within the oEmbed preview feature . The root cause is a failure to properly sandbox externally hosted scripts , allowing an attacker to craft malicious oEmbed content. This can lead to the execution of scripts in...

CVE-2026-103277 Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed

Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview feature that fails to sandbox externally hosted scripts. Attackers can craft malicious oEmbed content to execute scripts in the context of a staff user's admin session, potentially...

EUVD-2026-90670

Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview feature that fails to sandbox externally hosted scripts. Attackers can craft malicious oEmbed content to execute scripts in the context of a staff user's admin session, potentially...

BIT-DISCOURSE-2026-91132 Discourse: Wildcard iframe origin allowlist bypass via authority separators

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, sites using wildcard patterns in the allowediframes setting could accept a crafted iframe URL whose allowlisted suffix appeared after a URL authority separator. The wildcard origin check matched...

CVE-2026-103277: Improper Neutralization of Input During Web Page Generation

Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview feature that fails to sandbox externally hosted scripts. Attackers can craft malicious oEmbed content to execute scripts in the context of a staff user's admin session, potentially...

PT-2026-103976

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.6 Description The SSRF guard in the CMS resolves hosts using an IPv4-only function and fails to inspect IPv6 addresses. Consequently, any host lacking an A record bypasses the private-range check. An authenticated...

CVE-2026-55232: Server-Side Request Forgery (SSRF)

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's SSRF guard resolves a host with an IPv4-only function and never inspects IPv6, so any host that lacks an A record passes a private-range check. Editor oEmbed...

PT-2026-103809

Name of the Vulnerable Software and Affected Versions Ghost versions 2.5.0 through 6.33.x Description The oEmbed preview feature fails to sandbox externally hosted scripts, allowing for untrusted script execution. An attacker can create malicious oEmbed content to execute scripts within the...

PT-2026-105081

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, sites using wildcard patterns in the allowed iframes setting could accept a crafted iframe URL whose allowlisted suffix appeared after a URL authority separator. The wildcard origin check matched...

CVE-2026-91132

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, sites using wildcard patterns in the allowediframes setting could accept a crafted iframe URL whose allowlisted suffix appeared after a URL authority separator. The wildcard origin check matched...