https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 13:01:34 +0000 https://cve.radiocsirt.org/vuln/bit-ghost-2026-70590 <p><strong>Affected:</strong> Bitnami: ghost</p> <p>Ghost is a Node.js content management system. Prior to 6.54.1, any staff-level user was able to leak the hashed passwords of other staff users through the Ghost Admin API. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification should have prevented an attacker from logging in with a recovered password. Depending on the database used, leaked hashes may not have had the correct casing for all characters, increasing the difficulty of a password-guessing attack. This issue is fixed in version 6.54.1.</p> <p><strong>Affected:</strong> Bitnami: ghost</p> <p>Ghost is a Node.js content management system. Prior to 6.54.1, any staff-level user was able to leak the hashed passwords of other staff users through the Ghost Admin API. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification should have prevented an attacker from logging in with a recovered password. Depending on the database used, leaked hashes may not have had the correct casing for all characters, increasing the difficulty of a password-guessing attack. This issue is fixed in version 6.54.1.</p> https://cve.radiocsirt.org/vuln/bit-ghost-2026-70590 https://cve.radiocsirt.org/vuln/euvd-2026-348578 EUVD-2026-348578 https://cve.radiocsirt.org/vuln/euvd-2026-348578 https://cve.radiocsirt.org/vuln/fkie_cve-2026-70590 <p>Ghost is a Node.js content management system. Prior to 6.54.1, any staff-level user was able to leak the hashed passwords of other staff users through the Ghost Admin API. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification should have prevented an attacker from logging in with a recovered password. Depending on the database used, leaked hashes may not have had the correct casing for all characters, increasing the difficulty of a password-guessing attack. This issue is fixed in version 6.54.1.</p> <p>Ghost is a Node.js content management system. Prior to 6.54.1, any staff-level user was able to leak the hashed passwords of other staff users through the Ghost Admin API. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification should have prevented an attacker from logging in with a recovered password. Depending on the database used, leaked hashes may not have had the correct casing for all characters, increasing the difficulty of a password-guessing attack. This issue is fixed in version 6.54.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-70590 https://cve.radiocsirt.org/vuln/ghsa-jm22-3w23-5q7w <p><strong>Affected:</strong> npm: ghost</p> <p>### Impact</p> <p>Any staff-level user was able to leak the hashed passwords of other staff users. An offline password-guessing attack against the hashes could lead to account takeover if successful, but [Device Verification](https://docs.ghost.org/security#device-verification) should have prevented an attacker from logging in with a recovered password. Depending on the database used, leaked hashes may not have had the correct casing for all characters, increasing the difficulty of a password-guessing attack.</p> <p>### Vulnerable versions</p> <p>This vulnerability is present in Ghost versions v6.54.0 and earlier.</p> <p>### Patches</p> <p>v6.54.1 contains a fix for this issue.</p> <p>### How to update</p> <p>For self-hosters using Docker, find [Docker&#39;s official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docker-based Ghost instance [is documented here](https://docs.ghost.org/install/docker#updating-ghost).</p> <p>If your Ghost is a Ghost-CLI install see our documentation on [updating it to the latest version here](https://docs.ghost.org/update).</p> <p>### Workarounds</p> <p>If upgrading immediately is not possible, ensure all staff users have [Multi-factor Authentication](https://docs.ghost.org/security#email-2fa) (MFA) enabled. This will help prevent an attacker from logging in with any passwords that are successfully recovered from the leaked hashes.</p> <p>### References</p> <p>Ghost thanks Chapman Schleiss for disclosing this vulnerability responsibly.</p> <p>### For more information</p> <p>If you have any questions or comments a…</p> <p><strong>Affected:</strong> npm: ghost</p> <p>### Impact</p> <p>Any staff-level user was able to leak the hashed passwords of other staff users. An offline password-guessing attack against the hashes could lead to account takeover if successful, but [Device Verification](https://docs.ghost.org/security#device-verification) should have prevented an attacker from logging in with a recovered password. Depending on the database used, leaked hashes may not have had the correct casing for all characters, increasing the difficulty of a password-guessing attack.</p> <p>### Vulnerable versions</p> <p>This vulnerability is present in Ghost versions v6.54.0 and earlier.</p> <p>### Patches</p> <p>v6.54.1 contains a fix for this issue.</p> <p>### How to update</p> <p>For self-hosters using Docker, find [Docker&#39;s official Ghost image here](https://hub.docker.com/_/ghost). Updating a Docker-based Ghost instance [is documented here](https://docs.ghost.org/install/docker#updating-ghost).</p> <p>If your Ghost is a Ghost-CLI install see our documentation on [updating it to the latest version here](https://docs.ghost.org/update).</p> <p>### Workarounds</p> <p>If upgrading immediately is not possible, ensure all staff users have [Multi-factor Authentication](https://docs.ghost.org/security#email-2fa) (MFA) enabled. This will help prevent an attacker from logging in with any passwords that are successfully recovered from the leaked hashes.</p> <p>### References</p> <p>Ghost thanks Chapman Schleiss for disclosing this vulnerability responsibly.</p> <p>### For more information</p> <p>If you have any questions or comments a…</p> https://cve.radiocsirt.org/vuln/ghsa-jm22-3w23-5q7w