CVE-2026-26980

CVE-2026-26980 ★ CVE-2026-26980 TryGhost Ghost CMS Content API Injection SQL PoC ★ https://github.com/user-attachments/assets/e7fab29e-8382-4ecc-986c-68852c28a32c Aperçu CVE-2026-26980 est une vulnérabilité d'injection SQL non authentifiée dans l'API Content de TryGhost Ghost CMS. Le chemin...

CVE-2026-53950: Improper Neutralization of Input During Web Page Generation

@tryghost/activitypub is Ghost’s social/federation client app. Prior to 3.1.0, the ActivityPub client in Ghost was vulnerable to JavaScript injection on posts shared by a maliciously customised ActivityPub server. This vulnerability is fixed in 3.1.0...

Improper Access Control

ghost and @tryghost/portal is vulnerable for Improper Access Control. The vulnerability is due to missing authentication checks on certain endpoints used for member actions, allowing attackers to perform member-only actions and read member information without proper authorization...

Arbitrary File Read

@tryghost/zip is vulnerable to Arbitrary File Read. The vulnerability exists because the module.exports function of extract.js does not properly restrict symbolic links in uploaded files, which allows an attacker to upload a symlink, leading to arbitrary files read on the operating system...

TryGhost express-hbs information disclosure vulnerability

TryGhost express-hbs is an Express handlebar template engine with multiple layouts, blocks and cache sections. tryGhost express-hbs suffers from an information disclosure vulnerability that stems from the product's Express render API mixing pure template data with engine configuration options,...

TryGhost express-hbs 代码注入漏洞

TryGhost express-hbs is an Express handlebar template engine with multiple layouts, blocks and cache sections. tryGhost express-hbs suffers from an information disclosure vulnerability that stems from the product's Express render API mixing pure template data with engine configuration options,...