https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 22 Oct 2026 03:21:47 +0000 https://cve.radiocsirt.org/vuln/bit-ghost-2023-31133 <p><strong>Affected:</strong> Bitnami: ghost</p> <p>Ghost is an app for new-media creators with tools to build a website, publish content, send newsletters, and offer paid subscriptions to members. Prior to version 5.46.1, due to a lack of validation when filtering on the public API endpoints, it is possible to reveal private fields via a brute force attack.</p> <p>Ghost(Pro) has already been patched. Maintainers can find no evidence that the issue was exploited on Ghost(Pro) prior to the patch being added. Self-hosters are impacted if running Ghost a version below v5.46.1. v5.46.1 contains a fix for this issue. As a workaround, add a block for requests to `/ghost/api/content/*` where the `filter` query parameter contains `password` or `email`.</p> <p><strong>Affected:</strong> Bitnami: ghost</p> <p>Ghost is an app for new-media creators with tools to build a website, publish content, send newsletters, and offer paid subscriptions to members. Prior to version 5.46.1, due to a lack of validation when filtering on the public API endpoints, it is possible to reveal private fields via a brute force attack.</p> <p>Ghost(Pro) has already been patched. Maintainers can find no evidence that the issue was exploited on Ghost(Pro) prior to the patch being added. Self-hosters are impacted if running Ghost a version below v5.46.1. v5.46.1 contains a fix for this issue. As a workaround, add a block for requests to `/ghost/api/content/*` where the `filter` query parameter contains `password` or `email`.</p> https://cve.radiocsirt.org/vuln/bit-ghost-2023-31133 https://cve.radiocsirt.org/vuln/euvd-2026-212485 EUVD-2026-212485 https://cve.radiocsirt.org/vuln/euvd-2026-212485 https://cve.radiocsirt.org/vuln/fkie_cve-2023-31133 <p>Ghost is an app for new-media creators with tools to build a website, publish content, send newsletters, and offer paid subscriptions to members. Prior to version 5.46.1, due to a lack of validation when filtering on the public API endpoints, it is possible to reveal private fields via a brute force attack.</p> <p>Ghost(Pro) has already been patched. Maintainers can find no evidence that the issue was exploited on Ghost(Pro) prior to the patch being added. Self-hosters are impacted if running Ghost a version below v5.46.1. v5.46.1 contains a fix for this issue. As a workaround, add a block for requests to `/ghost/api/content/*` where the `filter` query parameter contains `password` or `email`.</p> <p>Ghost is an app for new-media creators with tools to build a website, publish content, send newsletters, and offer paid subscriptions to members. Prior to version 5.46.1, due to a lack of validation when filtering on the public API endpoints, it is possible to reveal private fields via a brute force attack.</p> <p>Ghost(Pro) has already been patched. Maintainers can find no evidence that the issue was exploited on Ghost(Pro) prior to the patch being added. Self-hosters are impacted if running Ghost a version below v5.46.1. v5.46.1 contains a fix for this issue. As a workaround, add a block for requests to `/ghost/api/content/*` where the `filter` query parameter contains `password` or `email`.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-31133 https://cve.radiocsirt.org/vuln/ghsa-r97q-ghch-82j9 <p><strong>Affected:</strong> npm: ghost</p> <p>### Impact</p> <p>Due to a lack of validation when filtering on the public API endpoints, it is possible to reveal private fields via a brute force attack.</p> <p>Ghost(Pro) has already been patched. We can find no evidence that the issue was exploited on Ghost(Pro) prior to the patch being added.</p> <p>Self-hosters are impacted if running Ghost a version below v5.46.1. Immediate action should be taken to secure your site - see patches and workarounds below.</p> <p>### Patches</p> <p>v5.46.1 contains a fix for this issue.</p> <p>### Workarounds</p> <p>Add a block for requests to `/ghost/api/content/*` where the `filter` query parameter contains `password` or `email`.</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory:</p> <p>* Email us at [security@ghost.org](mailto:security@ghost.org)</p> <p><strong>Affected:</strong> npm: ghost</p> <p>### Impact</p> <p>Due to a lack of validation when filtering on the public API endpoints, it is possible to reveal private fields via a brute force attack.</p> <p>Ghost(Pro) has already been patched. We can find no evidence that the issue was exploited on Ghost(Pro) prior to the patch being added.</p> <p>Self-hosters are impacted if running Ghost a version below v5.46.1. Immediate action should be taken to secure your site - see patches and workarounds below.</p> <p>### Patches</p> <p>v5.46.1 contains a fix for this issue.</p> <p>### Workarounds</p> <p>Add a block for requests to `/ghost/api/content/*` where the `filter` query parameter contains `password` or `email`.</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory:</p> <p>* Email us at [security@ghost.org](mailto:security@ghost.org)</p> https://cve.radiocsirt.org/vuln/ghsa-r97q-ghch-82j9 https://cve.radiocsirt.org/vuln/gsd-2023-31133 gsd-2023-31133 https://cve.radiocsirt.org/vuln/gsd-2023-31133