Threat database

A vulnerability in TryGhost Ghost versions 4.39.0 up to 6.64.0 allowed staff users with permission to view staff invites to discover secret tokens of pending invites, including those for roles with higher privileges. This could enable privilege escalation by accepting such invites. The issue is fixed in version 6.64.0.

CVE-2026-105652 is a low-severity vulnerability in TryGhost Ghost versions from 0.7.2 up to but not including 6.64.0. It allows any staff-level user to observe the relative ordering of other staff users' hashed passwords. This information disclosure does not reveal the actual password hashes nor does it provide a practical method to recover passwords. The issue is fixed in version 6.64.0.

A cross-site scripting (XSS) vulnerability exists in TryGhost Ghost when creating bookmark cards. Non-image files fetched from external websites could be stored as bookmark icons or thumbnails, allowing any staff user, including Contributors, to host arbitrary HTML on the site's domain. This may lead to compromise of other staff users' admin sessions. The vulnerability affects Ghost versions from 5.94.0 up to but not including 6.64.0. Version 6.64.0 contains a fix for this issue.

CVE-2026-105650 is a cross-site scripting (XSS) vulnerability in the TryGhost Ghost blogging platform affecting versions from 2.5.0 up to but not including 6.64.0. The flaw allows attacker-controlled URLs to embed untrusted scripts in post content, which may execute in the Ghost editor, on published sites, and in newsletter emails. This could lead to compromise of a staff user's administrative session. The issue is fixed in version 6.64.0.

CVE-2026-104030 is a vulnerability in the sssd component of Red Hat Enterprise Linux 10 that allows a local user to cause a Denial of Service (DoS). The flaw occurs when a specially crafted passkey authentication token lacking null terminators is submitted, causing an out-of-bounds read and process crash. This disrupts authentication services but does not impact confidentiality or integrity.

CVE-2026-71299 is a vulnerability in Red Hat Multicluster Engine for Kubernetes where the Maestro REST API write endpoints lack proper authentication. This flaw allows remote attackers to perform unauthorized write operations such as creating, modifying, or deleting consumers and resource bundles. The vulnerability can lead to data integrity issues or denial of service. It has a CVSS 3.1 score of 6.5, indicating medium severity. No affected versions or patch information are explicitly provided in the available data.

CVE-2026-71298 is a SQL injection vulnerability in Red Hat Multicluster Engine for Kubernetes. It affects the `orderBy` query parameter in the REST API list endpoints. The flaw allows a remote attacker to perform read-only blind extraction of data without authentication. The vulnerability has a medium severity with a CVSS score of 6.4.

A cross-site scripting (XSS) vulnerability exists in TryGhost Ghost where SVG media thumbnails and SVG images uploaded with incorrect file extensions were stored without proper sanitization. This flaw allows any staff user, including Contributors, to host malicious scripts on the site's domain, potentially compromising other staff users' admin sessions. The vulnerability affects Ghost versions from 4.22.0 up to but not including 6.65.0. Version 6.65.0 contains a fix for this issue.

A validation issue in TryGhost Ghost versions 6.0.9 through 6.64.0 allowed unauthenticated users to abuse certain functionality, such as Webmentions, to make limited HTTP requests to hosts within the Ghost server's internal network on some network configurations. The attack does not return response data. The vulnerability is fixed in version 6.65.0.

A time-of-check to time-of-use (TOCTOU) race condition vulnerability in TryGhost Ghost versions 6.54.1 through 6.64.0 allows unauthenticated users to abuse certain functionality, such as Webmentions, to make limited HTTP requests to hosts within the Ghost server's internal network. The attack does not return response data. The issue is fixed in version 6.65.0.

CVE-2026-103066 is a high-severity SQL Injection vulnerability in WP BASE Booking (wp-base-booking-of-appointments-services-and-events) that allows an attacker with low privileges to perform blind SQL injection. This affects versions from the initial release up to 6.4.0. The vulnerability can lead to high confidentiality impact and low availability impact. No official patch or remediation information is provided in the input data.

CVE-2026-100511 is a high-severity vulnerability in Vektor Inc.'s VK Google Job Posting Manager plugin. It involves deserialization of untrusted data leading to object injection. This flaw affects versions from initial releases up to 1.3.1 inclusive. The vulnerability allows an attacker with low privileges and no user interaction to achieve full confidentiality, integrity, and availability compromise. No known exploits are reported in the wild. No official patch or remediation details are provided in the available data.

CVE-2026-97257 is a high-severity vulnerability in PressTigers Simple Event Planner (versions before 1.5.8) involving deserialization of untrusted data that allows object injection. This flaw can lead to full compromise of confidentiality, integrity, and availability. The vulnerability affects versions from initial releases up to 1.5.7. No patch or remediation information is provided in the source data.

CVE-2026-93617 is a deserialization of untrusted data vulnerability in WP Sunshine's Sunshine Photo Cart plugin. This vulnerability allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. It affects versions from the initial release up to 3.7.1. The vulnerability has a high severity with a CVSS score of 7.2. No patch or remediation details are provided in the available data.

CVE-2026-103348 is a high severity vulnerability in Smackcoders Inc. WP Ultimate Exporter plugin that allows deserialization of untrusted data leading to object injection. This affects versions from initial release up to but not including 3.1. The vulnerability can result in complete compromise of confidentiality, integrity, and availability of the affected system. No known exploits are reported in the wild, and no patch information is provided in the source data.

CVE-2026-103337 is a Missing Authorization vulnerability in the Kirillbdev WC Ukraine Shipping plugin (wc-ukr-shipping) affecting versions from initial through 1.23.2. The flaw allows exploitation due to incorrectly configured access control security levels, potentially enabling unauthorized actions that impact integrity without affecting confidentiality or availability. The vulnerability has a CVSS 3.1 base score of 6.5 (medium severity).

CVE-2026-105326 is an argument injection vulnerability in the CUPS scheduler used in Red Hat Hardened Images. When email notifications are configured, the CUPS service improperly passes recipient addresses to the sendmail program without sanitizing input that could be interpreted as command-line options. This flaw allows a remote attacker with access to the CUPS service to supply crafted recipient values that may influence sendmail behavior and potentially execute commands with the privileges of the CUPS service user. The vulnerability's exploitation depends on the mail transfer agent installed and network exposure of the CUPS service. A security update addressing this issue is available from Red Hat.

CVE-2026-105646 is a vulnerability in TryGhost Ghost versions 4.0.0 up to 6.65.0 that allows an attacker with Administrator access to cause excessive CPU usage via crafted content import files, potentially making the server unresponsive. The issue is fixed in version 6.67.0. The vulnerability has a medium severity with a CVSS score of 4.9.

CVE-2026-105645 is a vulnerability in TryGhost Ghost affecting versions from 5.37.0 up to but not including 6.67.0. It involves inefficient regular expression complexity in the external media inliner component, which can be exploited by an attacker with Administrator access to cause excessive CPU usage and render the Ghost server unresponsive. A fix for this issue is available in version 6.67.0.

CVE-2026-105644 is a cross-site scripting (XSS) vulnerability in TryGhost Ghost that affects versions from 4.0.0 up to 6.66.x. The issue arises because SVG images included in content imports were stored without proper sanitization. An attacker who tricks an Administrator into importing a crafted SVG file could host malicious scripts on the site's domain, potentially compromising admin user sessions. The vulnerability is fixed in version 6.67.0.