https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-29784.htmlhttps://patchthecve.com/cve/CVE-2026-29784.htmlWed, 17 Jun 2026 10:29:52 +0000HIGH 7.5: Ghost is a Node.js content management system. From version 5.101.6 to 6.19.2, incomplete CSRF protections around /session/verify made it possible to use OTCs in login sessions different from the requesting session. In some scenarios this might have made it easier for phishers to take over a Ghost sihttps://patchthecve.com/cve/CVE-2026-29053.htmlhttps://patchthecve.com/cve/CVE-2026-29053.htmlWed, 17 Jun 2026 10:29:30 +0000HIGH 7.6: Ghost is a Node.js content management system. From version 0.7.2 to 6.19.0, specifically crafted malicious themes can execute arbitrary code on the server running Ghost. This issue has been patched in version 6.19.1.https://patchthecve.com/cve/CVE-2026-26980.htmlhttps://patchthecve.com/cve/CVE-2026-26980.htmlWed, 17 Jun 2026 10:26:28 +0000CRITICAL 9.4: Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.https://patchthecve.com/cve/CVE-2026-24778.htmlhttps://patchthecve.com/cve/CVE-2026-24778.htmlWed, 17 Jun 2026 10:23:34 +0000HIGH 8.8: Ghost is an open source content management system. In Ghost versions 5.43.0 through 5.12.04 and 6.0.0 through 6.14.0, an attacker was able to craft a malicious link that, when accessed by an authenticated staff user or member, would execute JavaScript with the victim's permissions, potentially leadihttps://patchthecve.com/cve/CVE-2024-43409.htmlhttps://patchthecve.com/cve/CVE-2024-43409.htmlWed, 17 Jun 2026 07:50:59 +0000MEDIUM 6.5: Ghost is a Node.js content management system. Improper authentication on some endpoints used for member actions would allow an attacker to perform member-only actions, and read member information. This security vulnerability is present in Ghost v4.46.0-v5.89.4. v5.89.5 contains a fix for this issue.https://patchthecve.com/cve/CVE-2024-34451.htmlhttps://patchthecve.com/cve/CVE-2024-34451.htmlWed, 17 Jun 2026 07:33:26 +0000CRITICAL 9.1: Ghost through 5.85.1 allows remote attackers to bypass an authentication rate-limit protection mechanism by using many X-Forwarded-For headers with different values. NOTE: the vendor's position is that Ghost should be installed with a reverse proxy that allows only trusted X-Forwarded-For headers.