Затронутые ветки версий
- 6.63 CVE: 8
- 6.62 CVE: 10
- 6.58 CVE: 14
- 6.57 CVE: 20
- 6.56 CVE: 20
- 6.51 CVE: 21
- 6.50 CVE: 22
- 6.44 CVE: 25
- 6.34 CVE: 25
- 6.27 CVE: 28
- 6.23 CVE: 30
- 6.22 CVE: 33
- 6.20 CVE: 32
- 6.19 CVE: 35
- 6.15 CVE: 35
- 6.14 CVE: 36
- 6.11 CVE: 35
- 6.10 CVE: 39
- 6.0 CVE: 38
- 5.130 CVE: 37
- 5.125 CVE: 37
- 5.121 CVE: 36
- 5.105 CVE: 36
- 5.101 CVE: 35
- 5.94 CVE: 34
- 5.90 CVE: 33
- 5.89 CVE: 33
- 5.85 CVE: 34
- 5.82 CVE: 34
- 5.76 CVE: 36
- 5.59 CVE: 38
- 5.46 CVE: 39
- 5.43 CVE: 39
- 5.42 CVE: 39
- 5.38 CVE: 38
- 5.35 CVE: 38
- 5.22 CVE: 38
- 5.19 CVE: 38
- 5.9 CVE: 37
- 5.8 CVE: 35
- 5.3 CVE: 34
- 5.2 CVE: 32
- 5.0 CVE: 31
- 4.48 CVE: 31
- 4.46 CVE: 31
- 4.42 CVE: 30
- 4.39 CVE: 30
- 4.10 CVE: 28
- 4.3 CVE: 30
- 4.0 CVE: 29
- 3.24 CVE: 26
- 3.23 CVE: 25
- 3.20 CVE: 24
- 3.10 CVE: 23
- 2.21 CVE: 23
- 2.10 CVE: 22
- 2.5 CVE: 21
- 1.20 CVE: 19
- 1.18 CVE: 18
- 1.0 CVE: 17
- 0.8 CVE: 16
- 0.7 CVE: 15
- 0.5 CVE: 14
Известные уязвимости
| CVE | Название | Затронутые версии | CVSS | Эксплуатируется | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
| CVE-2026-105683 | Ghost: Path Traversal Vulnerability in Ghost ImageSize Service | * | 3.8 | — | 2026-10-06 | |
| CVE-2026-105682 | Ghost: Server-Side Request Forgery in Webhook Trigger | * | 2.7 | — | 2026-10-06 | |
| CVE-2026-105681 | Ghost: Authorization Bypass in Comments Feature | * | 6.5 | — | 2026-10-06 | |
| CVE-2026-105680 | Ghost: Authorization Issue Allowed Author Role to Delete any Post | * | 6.5 | — | 2026-10-06 | |
| CVE-2026-105679 | Ghost: Stored XSS via File Uploads on Local Storage | * | 7.3 | — | 2026-10-06 | |
| CVE-2026-105678 | Ghost: Editors Could Promote Staff Users to Their Own Role | * | 4.3 | — | 2026-10-06 | |
| CVE-2026-105677 | Ghost: Remote Code Execution via Theme Translation Files | * | 7.2 | — | 2026-10-06 | |
| CVE-2026-105676 | Ghost: Path Traversal via Locale Setting | * | 4.9 | — | 2026-10-06 | |
| CVE-2026-105675 | Ghost: Invite Token Disclosure in Ghost Admin API | * | 7.5 | — | 2026-10-06 | |
| CVE-2026-105652 | Ghost: Password Hash Ordering Disclosure in Ghost Admin API | * | 3.1 | — | 2026-10-06 | |
| CVE-2026-105651 | Ghost: Stored XSS via Bookmark Card Images | * | 7.3 | — | 2026-10-06 | |
| CVE-2026-105650 | Ghost: Stored XSS via oEmbed Photo Responses | * | 8.1 | — | 2026-10-06 | |
| CVE-2026-105649 | Ghost: Stored XSS via SVG Uploads Bypassing Sanitization | * | 7.3 | — | 2026-10-06 | |
| CVE-2026-105648 | Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses | * | 4.0 | — | 2026-10-06 | |
| CVE-2026-105647 | Ghost: Server-Side Request Forgery in Bookmark Fetching | * | 4.0 | — | 2026-10-06 | |
| CVE-2026-105646 | Ghost: Regular Expression Denial of Service in Content Import | * | 4.9 | — | 2026-10-06 | |
| CVE-2026-105645 | Ghost: Regular Expression Denial of Service in External Media Inliner | * | 4.9 | — | 2026-10-06 | |
| CVE-2026-105644 | Ghost: Stored XSS via SVG Files in Content Imports | * | 6.8 | — | 2026-10-06 | |
| CVE-2026-105643 | Ghost: Stored XSS via Embed Card Previews | * | 7.3 | — | 2026-10-06 | |
| CVE-2026-105642 | Ghost: Remote Code Execution via Bookmark Card Images | * | 8.8 | — | 2026-10-06 | |
| CVE-2026-104418 | Ghost from 6.10.3 before 6.64.0 RCE via Theme Translation Files | ≥ 6.10.3 < 6.64.0 | 8.6 | — | 2026-10-02 | |
| CVE-2026-104416 | Ghost 4.39.0 before 6.64.0 Invite Token Disclosure via Admin API | ≥ 4.39.0 < 6.64.0 | 7.7 | — | 2026-10-02 | |
| CVE-2026-104417 | Ghost 1.20.0 before 6.64.0 Path Traversal via Locale Setting | ≥ 1.20.0 < 6.64.0 | 6.9 | — | 2026-10-02 | |
| CVE-2026-104415 | Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin API | ≥ 0.7.2 < 6.64.0 | 2.3 | — | 2026-10-02 | |
| CVE-2026-104414 | Ghost from 2.5.0 before 6.64.0 Stored XSS via oEmbed Photo Responses | ≥ 2.5.0 < 6.64.0 | 8.6 | — | 2026-10-02 | |
| CVE-2026-104413 | Ghost 5.94.0 before 6.64.0 Stored XSS via Bookmark Card Images | ≥ 5.94.0 < 6.64.0 | 8.5 | — | 2026-10-02 | |
| CVE-2026-104412 | Ghost 0.5.0 before 6.64.0 Privilege Escalation via Staff Role Assignment | ≥ 0.5.0 < 6.64.0 | 5.3 | — | 2026-10-02 | |
| CVE-2026-104411 | Ghost 6.22.1 before 6.64.0 Stored XSS via Local Storage File Uploads | ≥ 6.22.1 < 6.64.0 | 8.5 | — | 2026-10-02 | |
| CVE-2026-103292 | Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_head | ≥ 0.5.3 < 6.50.0 | 8.6 | — | 2026-10-01 | |
| CVE-2026-103291 | Ghost 3.20.2 before 6.51.0 SSRF via image-size fetch | ≥ 3.20.2 < 6.51.0 | 5.3 | — | 2026-10-01 | |
| CVE-2026-103290 | Ghost 6.14.0 before 6.27.0 Path Traversal via ImageSize | ≥ 6.14.0 < 6.27.0 | 5.1 | — | 2026-10-01 | |
| CVE-2026-103289 | Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments | ≥ 5.9.0 < 6.44.1 | 7.1 | — | 2026-10-01 | |
| CVE-2026-103288 | Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like | ≥ 5.9.0 < 6.44.1 | 7.1 | — | 2026-10-01 | |
| CVE-2026-103287 | Ghost 1.18.0 before 6.27.0 Server-Side Request Forgery via Webhook | ≥ 1.18.0 < 6.27.0 | 5.1 | — | 2026-10-01 | |
| CVE-2026-103286 | Ghost 2.21.0 before 6.56.0 Privilege Escalation via Notifications | ≥ 2.21.0 < 6.56.0 | 8.5 | — | 2026-10-01 | |
| CVE-2026-103285 | Ghost 5.19.0 before 6.57.1 Cross-Site Request Forgery | ≥ 5.19.0 < 6.57.1 | 5.3 | — | 2026-10-01 | |
| CVE-2026-103284 | Ghost 5.125.1 before 6.57.1 Information Disclosure via Feedback | ≥ 5.125.1 < 6.57.1 | 5.3 | — | 2026-10-01 | |
| CVE-2026-103282 | Ghost 0.5.0 before 6.23.0 Multiple Account Creation via Invite Token | ≥ 0.5.0 < 6.23.0 | 5.3 | — | 2026-10-01 | |
| CVE-2026-103283 | Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling | ≥ 6.20.0 < 6.57.1 | 8.6 | — | 2026-10-01 | |
| CVE-2026-103281 | Ghost 3.23.0 before 6.23.0 API Key Exposure via Admin API | ≥ 3.23.0 < 6.23.0 | 5.3 | — | 2026-10-01 | |
| CVE-2026-103280 | Ghost 0.8.0 before 6.23.0 Information Disclosure via Setup Endpoint | ≥ 0.8.0 < 6.23.0 | 6.9 | — | 2026-10-01 | |
| CVE-2026-103279 | Ghost 3.10.0 before 6.34.0 Session Invalidation Bypass | ≥ 3.10.0 < 6.34.0 | 7.6 | — | 2026-10-01 | |
| CVE-2026-103278 | Ghost 5.8.0 before 6.34.0 Staff Account Takeover via Admin iframe | ≥ 5.8.0 < 6.34.0 | 8.5 | — | 2026-10-01 | |
| CVE-2026-103277 | Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed | ≥ 2.5.0 < 6.34.0 | 8.6 | — | 2026-10-01 | |
| CVE-2026-103276 | Ghost before 6.20.0 File Read via URL Encoding Bypass | < 6.20.0 | 6.9 | — | 2026-10-01 | |
| CVE-2026-103275 | Ghost 5.42.2 before 6.58.0 Password Hash Disclosure | ≥ 5.42.2 < 6.58.0 | 5.3 | — | 2026-10-01 | |
| CVE-2026-103274 | Ghost 5.3.0 before 6.58.0 Unauthenticated Comment Read | ≥ 5.3.0 < 6.58.0 | 6.9 | — | 2026-10-01 | |
| CVE-2026-103272 | Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content API | ≥ 2.10.0 < 6.63.0 | 8.7 | — | 2026-10-01 | |
| CVE-2026-103273 | Ghost 4.3.0 before 6.58.0 Incorrect Authorization via Staff Token | ≥ 4.3.0 < 6.58.0 | 5.3 | — | 2026-10-01 | |
| CVE-2026-103271 | Ghost 4.0.0 before 6.63.0 Restricted Content Bypass | ≥ 4.0.0 < 6.63.0 | 8.7 | — | 2026-10-01 | |
| CVE-2026-103269 | Ghost 5.3.0 before 6.62.0 Missing Authorization via Post Excerpts | ≥ 5.3.0 < 6.62.0 | 6.9 | — | 2026-10-01 | |
| CVE-2026-103268 | Ghost 1.0.0 before 6.62.0 Suspension Bypass via Password Reset | ≥ 1.0.0 < 6.62.0 | 8.7 | — | 2026-10-01 | |
| CVE-2026-103267 | Ghost 0.5.0 before 6.62.0 Arbitrary Email Registration via Staff Invite | ≥ 0.5.0 < 6.62.0 | 5.3 | — | 2026-10-01 | |
| CVE-2026-103266 | Ghost 5.2.0 before 6.62.0 Unauthenticated Stripe Checkout Account Modification | ≥ 5.2.0 < 6.62.0 | 7.1 | — | 2026-10-01 | |
| CVE-2026-70596 | Ghost: Cross-Site Scripting in Feature Image Captions | * | 4.3 | — | 2026-08-05 | |
| CVE-2026-70595 | Ghost: Server-Side Request Forgery Mitigation Issue | * | 4.0 | — | 2026-08-05 | |
| CVE-2026-70594 | Ghost: Session Fixation in Ghost Admin | * | 6.7 | — | 2026-08-05 | |
| CVE-2026-70593 | Ghost: Theme Upload Path Traversal | * | 6.6 | — | 2026-08-05 | |
| CVE-2026-70592 | Ghost: Database Backup Path Traversal | * | 5.5 | — | 2026-08-05 | |
| CVE-2026-70591 | Ghost: Server-Side Request Forgery in Image Fetching | * | 4.1 | — | 2026-08-05 |
Отслеживайте эти версии на своих серверах
InfraGuard собирает версии установленного ПО со всех серверов и отмечает версии с известными уязвимостями. Self-hosted — данные не покидают вашу сеть.
Данные: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (об EPSS см. https://www.first.org/epss), endoflife.date. Список ПО: awesome-selfhosted (CC BY-SA 3.0).