Exposición de Ghost

Blogs, CMS
83
score de exposición
3066
sitios usan
0
en explotación
7
críticos
Análisis Vexday

O Ghost acumula 31 CVEs catalogadas, das quais nenhuma consta no catálogo KEV da CISA, posicionando a tecnologia abaixo da média geral do catálogo em termos de exploração ativa confirmada. Ainda assim, o volume de 8 vulnerabilidades surgidas nos últimos 90 dias e a existência de 7 de severidade crítica indicam uma superfície de ataque em expansão que merece acompanhamento contínuo. O tipo de falha mais recorrente é CWE-918 (Server-Side Request Forgery), o que sugere fragilidades na forma como a aplicação realiza requisições externas — uma classe de vulnerabilidade frequentemente encadeada em ataques mais complexos. A CVE mais preocupante no momento é CVE-2026-26980, com pontuação EPSS de aproximadamente 0,70, sinalizando probabilidade relevante de exploração em curto prazo e justificando priorização imediata nas rotinas de patching.

CVEs

41 resultados
CVE-2026-70593MEDIUMGhost: Theme Upload Path TraversalEPSS 0.3%CVE-2026-53943CRITICALGhost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview headerEPSS 0.3%CVE-2026-22597MEDIUMGhost has SSRF via External Media InlinerEPSS 0.3%CVE-2026-70588MEDIUMGhost: Cross-Site Scripting in Universal ImportEPSS 0.3%CVE-2026-59817MEDIUMGhost: Paid gift memberships obtainable at minimal cost via the donations featureEPSS 0.3%CVE-2026-24778HIGHGhost vulnerable to XSS via malicious Portal preview linksEPSS 0.3%CVE-2026-70591MEDIUMGhost: Server-Side Request Forgery in Image FetchingEPSS 0.2%CVE-2026-53949MEDIUMGhost Content API filter bypass reveals private fieldsEPSS 0.2%CVE-2026-53947MEDIUMGhost: Member existence leak via magic link sign-in responseEPSS 0.2%CVE-2026-53950HIGH@tryghost/activitypub: XSS in Ghost's ActivityPub clientEPSS 0.2%CVE-2026-53944MEDIUMGhost: Private IP filtering bypass to make server-side requests to internal servicesEPSS 0.2%CVE-2026-70590MEDIUMGhost: Blind Password Hash Disclosure in Ghost Admin APIEPSS 0.2%CVE-2026-70596MEDIUMGhost: Cross-Site Scripting in Feature Image CaptionsEPSS 0.2%CVE-2026-26365MEDIUMAkamai Ghost on Akamai CDN edge servers before 2026-02-06 mishandles processing of custom hop-by-hop HTTP headers, where an incoming requestEPSS 0.2%CVE-2026-70595MEDIUMGhost: Server-Side Request Forgery Mitigation IssueEPSS 0.2%CVE-2026-70589MEDIUMGhost: Archived Offers can be RedeemedEPSS 0.2%CVE-2026-70594MEDIUMGhost: Session Fixation in Ghost AdminEPSS 0.2%CVE-2026-29784HIGHGhost: Incomplete CSRF protections around OTC useEPSS 0.2%CVE-2026-53945MEDIUMGhost: Server-side request forgery via DNS rebinding in external request handlingEPSS 0.1%CVE-2026-53948MEDIUMGhost: File Upload Content-Type SpoofingEPSS 0.1%