https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 15:12:15 +0000 https://cve.radiocsirt.org/vuln/bit-ghost-2026-53949 <p><strong>Affected:</strong> Bitnami: ghost</p> <p>Ghost is a Node.js content management system. From 5.46.1 until 6.21.2, the validation applied to filters on the public API endpoints could be partially bypassed, making it possible to reveal private fields via a brute force attack. If SQLite was used as the database password hashes were fully accessible. If MySQL was used as the database the password hashes&#39; case (uppercase / lowercase) would have been lost, which would likely have rendered a further brute force attack on the discovered hashes fruitless. This vulnerability is fixed in 6.21.2.</p> <p><strong>Affected:</strong> Bitnami: ghost</p> <p>Ghost is a Node.js content management system. From 5.46.1 until 6.21.2, the validation applied to filters on the public API endpoints could be partially bypassed, making it possible to reveal private fields via a brute force attack. If SQLite was used as the database password hashes were fully accessible. If MySQL was used as the database the password hashes&#39; case (uppercase / lowercase) would have been lost, which would likely have rendered a further brute force attack on the discovered hashes fruitless. This vulnerability is fixed in 6.21.2.</p> https://cve.radiocsirt.org/vuln/bit-ghost-2026-53949 https://cve.radiocsirt.org/vuln/euvd-2026-330026 EUVD-2026-330026 https://cve.radiocsirt.org/vuln/euvd-2026-330026 https://cve.radiocsirt.org/vuln/fkie_cve-2026-53949 <p>Ghost is a Node.js content management system. From 5.46.1 until 6.21.2, the validation applied to filters on the public API endpoints could be partially bypassed, making it possible to reveal private fields via a brute force attack. If SQLite was used as the database password hashes were fully accessible. If MySQL was used as the database the password hashes&#39; case (uppercase / lowercase) would have been lost, which would likely have rendered a further brute force attack on the discovered hashes fruitless. This vulnerability is fixed in 6.21.2.</p> <p>Ghost is a Node.js content management system. From 5.46.1 until 6.21.2, the validation applied to filters on the public API endpoints could be partially bypassed, making it possible to reveal private fields via a brute force attack. If SQLite was used as the database password hashes were fully accessible. If MySQL was used as the database the password hashes&#39; case (uppercase / lowercase) would have been lost, which would likely have rendered a further brute force attack on the discovered hashes fruitless. This vulnerability is fixed in 6.21.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-53949 https://cve.radiocsirt.org/vuln/ghsa-jx35-x7fj-vgpr <p><strong>Affected:</strong> npm: ghost</p> <p>### Impact</p> <p>The validation applied to filters on the public API endpoints could be partially bypassed, making it possible to reveal private fields via a brute force attack. If SQLite was used as the database password hashes were fully accessible. If MySQL was used as the database the password hashes&#39; case (uppercase / lowercase) would have been lost, which would likely have rendered a further brute force attack on the discovered hashes fruitless.</p> <p>### Vulnerable versions</p> <p>This vulnerability is present in Ghost from v5.46.1 up to v6.21.1.</p> <p>### Patches</p> <p>v6.21.2 contains a fix for this issue.</p> <p>### How to update</p> <p>For self-hosters using Docker, find [Docker&#39;s official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docker-based Ghost instance [is documented here](https://docs.ghost.org/install/docker#updating-ghost).</p> <p>If your Ghost is a Ghost-CLI install see our documentation on [updating it to the latest version here](https://docs.ghost.org/update).</p> <p>### Workarounds</p> <p>If upgrading immediately is not possible, block or filter requests to Content API endpoints where the `filter` query parameter contains `password` or `email` (including any compound form such as `users.password`, `users.email`, `authors.password`, `authors.email`). Reject requests at a reverse proxy / WAF layer before they reach Ghost.</p> <p>Example (case-insensitive) pattern to block on the raw querystring:</p> <p>``` filter=[^&amp;]*(password|email) ```</p> <p>### References</p> <p>Ghost thanks crnkovic for disclosing this v…</p> <p><strong>Affected:</strong> npm: ghost</p> <p>### Impact</p> <p>The validation applied to filters on the public API endpoints could be partially bypassed, making it possible to reveal private fields via a brute force attack. If SQLite was used as the database password hashes were fully accessible. If MySQL was used as the database the password hashes&#39; case (uppercase / lowercase) would have been lost, which would likely have rendered a further brute force attack on the discovered hashes fruitless.</p> <p>### Vulnerable versions</p> <p>This vulnerability is present in Ghost from v5.46.1 up to v6.21.1.</p> <p>### Patches</p> <p>v6.21.2 contains a fix for this issue.</p> <p>### How to update</p> <p>For self-hosters using Docker, find [Docker&#39;s official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docker-based Ghost instance [is documented here](https://docs.ghost.org/install/docker#updating-ghost).</p> <p>If your Ghost is a Ghost-CLI install see our documentation on [updating it to the latest version here](https://docs.ghost.org/update).</p> <p>### Workarounds</p> <p>If upgrading immediately is not possible, block or filter requests to Content API endpoints where the `filter` query parameter contains `password` or `email` (including any compound form such as `users.password`, `users.email`, `authors.password`, `authors.email`). Reject requests at a reverse proxy / WAF layer before they reach Ghost.</p> <p>Example (case-insensitive) pattern to block on the raw querystring:</p> <p>``` filter=[^&amp;]*(password|email) ```</p> <p>### References</p> <p>Ghost thanks crnkovic for disclosing this v…</p> https://cve.radiocsirt.org/vuln/ghsa-jx35-x7fj-vgpr