https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 00:41:50 +0000 https://cve.radiocsirt.org/vuln/bit-ghost-2026-53950 <p><strong>Affected:</strong> Bitnami: ghost</p> <p>@tryghost/activitypub is Ghost’s social/federation client app. Prior to 3.1.0, the ActivityPub client in Ghost was vulnerable to JavaScript injection on posts shared by a maliciously customised ActivityPub server. This vulnerability is fixed in 3.1.0.</p> <p><strong>Affected:</strong> Bitnami: ghost</p> <p>@tryghost/activitypub is Ghost’s social/federation client app. Prior to 3.1.0, the ActivityPub client in Ghost was vulnerable to JavaScript injection on posts shared by a maliciously customised ActivityPub server. This vulnerability is fixed in 3.1.0.</p> https://cve.radiocsirt.org/vuln/bit-ghost-2026-53950 https://cve.radiocsirt.org/vuln/euvd-2026-330021 EUVD-2026-330021 https://cve.radiocsirt.org/vuln/euvd-2026-330021 https://cve.radiocsirt.org/vuln/fkie_cve-2026-53950 <p>@tryghost/activitypub is Ghost’s social/federation client app. Prior to 3.1.0, the ActivityPub client in Ghost was vulnerable to JavaScript injection on posts shared by a maliciously customised ActivityPub server. This vulnerability is fixed in 3.1.0.</p> <p>@tryghost/activitypub is Ghost’s social/federation client app. Prior to 3.1.0, the ActivityPub client in Ghost was vulnerable to JavaScript injection on posts shared by a maliciously customised ActivityPub server. This vulnerability is fixed in 3.1.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-53950 https://cve.radiocsirt.org/vuln/ghsa-xpp7-93x6-v29m <p><strong>Affected:</strong> npm: @tryghost/activitypub</p> <p>### Impact</p> <p>The ActivityPub client in Ghost was vulnerable to JavaScript injection on posts shared by a maliciously customised ActivityPub server.</p> <p>### Vulnerable Versions</p> <p>This vulnerability is present in the @tryghost/activitypub package up to v3.0.8. All prior versions are also affected.</p> <p>### Patches</p> <p>@tryghost/activitypub v3.1.0 contains a fix for this issue and is also automatically fetched by Ghost.</p> <p>### References</p> <p>Ghost thanks Brad Geesaman, Ghost Security for disclosing this vulnerability responsibly.</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory, email Ghost at [security@ghost.org](mailto:security@ghost.org).</p> <p><strong>Affected:</strong> npm: @tryghost/activitypub</p> <p>### Impact</p> <p>The ActivityPub client in Ghost was vulnerable to JavaScript injection on posts shared by a maliciously customised ActivityPub server.</p> <p>### Vulnerable Versions</p> <p>This vulnerability is present in the @tryghost/activitypub package up to v3.0.8. All prior versions are also affected.</p> <p>### Patches</p> <p>@tryghost/activitypub v3.1.0 contains a fix for this issue and is also automatically fetched by Ghost.</p> <p>### References</p> <p>Ghost thanks Brad Geesaman, Ghost Security for disclosing this vulnerability responsibly.</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory, email Ghost at [security@ghost.org](mailto:security@ghost.org).</p> https://cve.radiocsirt.org/vuln/ghsa-xpp7-93x6-v29m