影響を受けるバージョン系列
- 6.63 CVE 8 件
- 6.62 CVE 10 件
- 6.58 CVE 14 件
- 6.57 CVE 20 件
- 6.56 CVE 20 件
- 6.51 CVE 21 件
- 6.50 CVE 22 件
- 6.44 CVE 25 件
- 6.34 CVE 25 件
- 6.27 CVE 28 件
- 6.23 CVE 30 件
- 6.22 CVE 33 件
- 6.20 CVE 32 件
- 6.19 CVE 35 件
- 6.15 CVE 35 件
- 6.14 CVE 36 件
- 6.11 CVE 35 件
- 6.10 CVE 39 件
- 6.0 CVE 38 件
- 5.130 CVE 37 件
- 5.125 CVE 37 件
- 5.121 CVE 36 件
- 5.105 CVE 36 件
- 5.101 CVE 35 件
- 5.94 CVE 34 件
- 5.90 CVE 33 件
- 5.89 CVE 33 件
- 5.85 CVE 34 件
- 5.82 CVE 34 件
- 5.76 CVE 36 件
- 5.59 CVE 38 件
- 5.46 CVE 39 件
- 5.43 CVE 39 件
- 5.42 CVE 39 件
- 5.38 CVE 38 件
- 5.35 CVE 38 件
- 5.22 CVE 38 件
- 5.19 CVE 38 件
- 5.9 CVE 37 件
- 5.8 CVE 35 件
- 5.3 CVE 34 件
- 5.2 CVE 32 件
- 5.0 CVE 31 件
- 4.48 CVE 31 件
- 4.46 CVE 31 件
- 4.42 CVE 30 件
- 4.39 CVE 30 件
- 4.10 CVE 28 件
- 4.3 CVE 30 件
- 4.0 CVE 29 件
- 3.24 CVE 26 件
- 3.23 CVE 25 件
- 3.20 CVE 24 件
- 3.10 CVE 23 件
- 2.21 CVE 23 件
- 2.10 CVE 22 件
- 2.5 CVE 21 件
- 1.20 CVE 19 件
- 1.18 CVE 18 件
- 1.0 CVE 17 件
- 0.8 CVE 16 件
- 0.7 CVE 15 件
- 0.5 CVE 14 件
既知の脆弱性
| CVE | タイトル | 影響を受けるバージョン | CVSS | 悪用 | EPSS | 公開日 |
|---|---|---|---|---|---|---|
| CVE-2026-105683 | Ghost: Path Traversal Vulnerability in Ghost ImageSize Service | * | 3.8 | — | 2026-10-06 | |
| CVE-2026-105682 | Ghost: Server-Side Request Forgery in Webhook Trigger | * | 2.7 | — | 2026-10-06 | |
| CVE-2026-105681 | Ghost: Authorization Bypass in Comments Feature | * | 6.5 | — | 2026-10-06 | |
| CVE-2026-105680 | Ghost: Authorization Issue Allowed Author Role to Delete any Post | * | 6.5 | — | 2026-10-06 | |
| CVE-2026-105679 | Ghost: Stored XSS via File Uploads on Local Storage | * | 7.3 | — | 2026-10-06 | |
| CVE-2026-105678 | Ghost: Editors Could Promote Staff Users to Their Own Role | * | 4.3 | — | 2026-10-06 | |
| CVE-2026-105677 | Ghost: Remote Code Execution via Theme Translation Files | * | 7.2 | — | 2026-10-06 | |
| CVE-2026-105676 | Ghost: Path Traversal via Locale Setting | * | 4.9 | — | 2026-10-06 | |
| CVE-2026-105675 | Ghost: Invite Token Disclosure in Ghost Admin API | * | 7.5 | — | 2026-10-06 | |
| CVE-2026-105652 | Ghost: Password Hash Ordering Disclosure in Ghost Admin API | * | 3.1 | — | 2026-10-06 | |
| CVE-2026-105651 | Ghost: Stored XSS via Bookmark Card Images | * | 7.3 | — | 2026-10-06 | |
| CVE-2026-105650 | Ghost: Stored XSS via oEmbed Photo Responses | * | 8.1 | — | 2026-10-06 | |
| CVE-2026-105649 | Ghost: Stored XSS via SVG Uploads Bypassing Sanitization | * | 7.3 | — | 2026-10-06 | |
| CVE-2026-105648 | Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses | * | 4.0 | — | 2026-10-06 | |
| CVE-2026-105647 | Ghost: Server-Side Request Forgery in Bookmark Fetching | * | 4.0 | — | 2026-10-06 | |
| CVE-2026-105646 | Ghost: Regular Expression Denial of Service in Content Import | * | 4.9 | — | 2026-10-06 | |
| CVE-2026-105645 | Ghost: Regular Expression Denial of Service in External Media Inliner | * | 4.9 | — | 2026-10-06 | |
| CVE-2026-105644 | Ghost: Stored XSS via SVG Files in Content Imports | * | 6.8 | — | 2026-10-06 | |
| CVE-2026-105643 | Ghost: Stored XSS via Embed Card Previews | * | 7.3 | — | 2026-10-06 | |
| CVE-2026-105642 | Ghost: Remote Code Execution via Bookmark Card Images | * | 8.8 | — | 2026-10-06 | |
| CVE-2026-104418 | Ghost from 6.10.3 before 6.64.0 RCE via Theme Translation Files | ≥ 6.10.3 < 6.64.0 | 8.6 | — | 2026-10-02 | |
| CVE-2026-104416 | Ghost 4.39.0 before 6.64.0 Invite Token Disclosure via Admin API | ≥ 4.39.0 < 6.64.0 | 7.7 | — | 2026-10-02 | |
| CVE-2026-104417 | Ghost 1.20.0 before 6.64.0 Path Traversal via Locale Setting | ≥ 1.20.0 < 6.64.0 | 6.9 | — | 2026-10-02 | |
| CVE-2026-104415 | Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin API | ≥ 0.7.2 < 6.64.0 | 2.3 | — | 2026-10-02 | |
| CVE-2026-104414 | Ghost from 2.5.0 before 6.64.0 Stored XSS via oEmbed Photo Responses | ≥ 2.5.0 < 6.64.0 | 8.6 | — | 2026-10-02 | |
| CVE-2026-104413 | Ghost 5.94.0 before 6.64.0 Stored XSS via Bookmark Card Images | ≥ 5.94.0 < 6.64.0 | 8.5 | — | 2026-10-02 | |
| CVE-2026-104412 | Ghost 0.5.0 before 6.64.0 Privilege Escalation via Staff Role Assignment | ≥ 0.5.0 < 6.64.0 | 5.3 | — | 2026-10-02 | |
| CVE-2026-104411 | Ghost 6.22.1 before 6.64.0 Stored XSS via Local Storage File Uploads | ≥ 6.22.1 < 6.64.0 | 8.5 | — | 2026-10-02 | |
| CVE-2026-103292 | Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_head | ≥ 0.5.3 < 6.50.0 | 8.6 | — | 2026-10-01 | |
| CVE-2026-103291 | Ghost 3.20.2 before 6.51.0 SSRF via image-size fetch | ≥ 3.20.2 < 6.51.0 | 5.3 | — | 2026-10-01 | |
| CVE-2026-103290 | Ghost 6.14.0 before 6.27.0 Path Traversal via ImageSize | ≥ 6.14.0 < 6.27.0 | 5.1 | — | 2026-10-01 | |
| CVE-2026-103289 | Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments | ≥ 5.9.0 < 6.44.1 | 7.1 | — | 2026-10-01 | |
| CVE-2026-103288 | Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like | ≥ 5.9.0 < 6.44.1 | 7.1 | — | 2026-10-01 | |
| CVE-2026-103287 | Ghost 1.18.0 before 6.27.0 Server-Side Request Forgery via Webhook | ≥ 1.18.0 < 6.27.0 | 5.1 | — | 2026-10-01 | |
| CVE-2026-103286 | Ghost 2.21.0 before 6.56.0 Privilege Escalation via Notifications | ≥ 2.21.0 < 6.56.0 | 8.5 | — | 2026-10-01 | |
| CVE-2026-103285 | Ghost 5.19.0 before 6.57.1 Cross-Site Request Forgery | ≥ 5.19.0 < 6.57.1 | 5.3 | — | 2026-10-01 | |
| CVE-2026-103284 | Ghost 5.125.1 before 6.57.1 Information Disclosure via Feedback | ≥ 5.125.1 < 6.57.1 | 5.3 | — | 2026-10-01 | |
| CVE-2026-103282 | Ghost 0.5.0 before 6.23.0 Multiple Account Creation via Invite Token | ≥ 0.5.0 < 6.23.0 | 5.3 | — | 2026-10-01 | |
| CVE-2026-103283 | Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling | ≥ 6.20.0 < 6.57.1 | 8.6 | — | 2026-10-01 | |
| CVE-2026-103281 | Ghost 3.23.0 before 6.23.0 API Key Exposure via Admin API | ≥ 3.23.0 < 6.23.0 | 5.3 | — | 2026-10-01 | |
| CVE-2026-103280 | Ghost 0.8.0 before 6.23.0 Information Disclosure via Setup Endpoint | ≥ 0.8.0 < 6.23.0 | 6.9 | — | 2026-10-01 | |
| CVE-2026-103279 | Ghost 3.10.0 before 6.34.0 Session Invalidation Bypass | ≥ 3.10.0 < 6.34.0 | 7.6 | — | 2026-10-01 | |
| CVE-2026-103278 | Ghost 5.8.0 before 6.34.0 Staff Account Takeover via Admin iframe | ≥ 5.8.0 < 6.34.0 | 8.5 | — | 2026-10-01 | |
| CVE-2026-103277 | Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed | ≥ 2.5.0 < 6.34.0 | 8.6 | — | 2026-10-01 | |
| CVE-2026-103276 | Ghost before 6.20.0 File Read via URL Encoding Bypass | < 6.20.0 | 6.9 | — | 2026-10-01 | |
| CVE-2026-103275 | Ghost 5.42.2 before 6.58.0 Password Hash Disclosure | ≥ 5.42.2 < 6.58.0 | 5.3 | — | 2026-10-01 | |
| CVE-2026-103274 | Ghost 5.3.0 before 6.58.0 Unauthenticated Comment Read | ≥ 5.3.0 < 6.58.0 | 6.9 | — | 2026-10-01 | |
| CVE-2026-103272 | Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content API | ≥ 2.10.0 < 6.63.0 | 8.7 | — | 2026-10-01 | |
| CVE-2026-103273 | Ghost 4.3.0 before 6.58.0 Incorrect Authorization via Staff Token | ≥ 4.3.0 < 6.58.0 | 5.3 | — | 2026-10-01 | |
| CVE-2026-103271 | Ghost 4.0.0 before 6.63.0 Restricted Content Bypass | ≥ 4.0.0 < 6.63.0 | 8.7 | — | 2026-10-01 | |
| CVE-2026-103269 | Ghost 5.3.0 before 6.62.0 Missing Authorization via Post Excerpts | ≥ 5.3.0 < 6.62.0 | 6.9 | — | 2026-10-01 | |
| CVE-2026-103268 | Ghost 1.0.0 before 6.62.0 Suspension Bypass via Password Reset | ≥ 1.0.0 < 6.62.0 | 8.7 | — | 2026-10-01 | |
| CVE-2026-103267 | Ghost 0.5.0 before 6.62.0 Arbitrary Email Registration via Staff Invite | ≥ 0.5.0 < 6.62.0 | 5.3 | — | 2026-10-01 | |
| CVE-2026-103266 | Ghost 5.2.0 before 6.62.0 Unauthenticated Stripe Checkout Account Modification | ≥ 5.2.0 < 6.62.0 | 7.1 | — | 2026-10-01 | |
| CVE-2026-70596 | Ghost: Cross-Site Scripting in Feature Image Captions | * | 4.3 | — | 2026-08-05 | |
| CVE-2026-70595 | Ghost: Server-Side Request Forgery Mitigation Issue | * | 4.0 | — | 2026-08-05 | |
| CVE-2026-70594 | Ghost: Session Fixation in Ghost Admin | * | 6.7 | — | 2026-08-05 | |
| CVE-2026-70593 | Ghost: Theme Upload Path Traversal | * | 6.6 | — | 2026-08-05 | |
| CVE-2026-70592 | Ghost: Database Backup Path Traversal | * | 5.5 | — | 2026-08-05 | |
| CVE-2026-70591 | Ghost: Server-Side Request Forgery in Image Fetching | * | 4.1 | — | 2026-08-05 |
データ：CVE List（CVE® Program）、NVD、CISA KEV、FIRST EPSS（EPSS については https://www.first.org/epss を参照）、endoflife.date。ソフトウェア一覧：awesome-selfhosted（CC BY-SA 3.0）。