CVE Vulnerability Database
Search and browse 425,078 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-103283 | HIGH | 8.1 | 0.3% | Oct 1, 2026 | Ghost versions 6.20.0 before 6.57.1 contain a session handling vulnerability that allows authenticated staff users to lo... |
| CVE-2026-103282 | MEDIUM | 4.3 | — | Oct 1, 2026 | Ghost versions 0.5.0 before 6.23.0 contain a concurrency issue in the staff invitation acceptance mechanism that allows ... |
| CVE-2026-103281 | MEDIUM | 5.4 | — | Oct 1, 2026 | Ghost (npm package 'ghost') versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-priv... |
| CVE-2026-103280 | MEDIUM | 5.3 | — | Oct 1, 2026 | Ghost from version 0.8.0 before 6.23.0 contains an information disclosure vulnerability in its setup endpoint: the endpo... |
| CVE-2026-103279 | MEDIUM | 6.8 | 0.2% | Oct 1, 2026 | Ghost versions from 3.10.0 before 6.34.0 fail to fully invalidate all sessions after a password change. Attackers with a... |
| CVE-2026-103278 | HIGH | 7.3 | — | Oct 1, 2026 | Ghost versions 5.8.0 before 6.34.0 contain an input validation vulnerability in the admin iframe that allows attackers t... |
| CVE-2026-103277 | HIGH | 8.1 | — | Oct 1, 2026 | Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview featur... |
| CVE-2026-103276 | MEDIUM | 5.3 | — | Oct 1, 2026 | Ghost versions before 6.20.0 contain a file extension filtering bypass vulnerability that allows unauthenticated attacke... |
| CVE-2026-103275 | MEDIUM | 4.3 | 0.2% | Oct 1, 2026 | Ghost 5.42.2 before 6.58.0 contains an information disclosure vulnerability in the Admin API bulk post and page edit and... |
| CVE-2026-103274 | MEDIUM | 5.3 | — | Oct 1, 2026 | Ghost versions 5.3.0 before 6.58.0 fail to properly enforce access controls on comments in private mode. Unauthenticated... |
| CVE-2026-103273 | MEDIUM | 4.3 | — | Oct 1, 2026 | Ghost versions 4.3.0 before 6.58.0 contain an authentication bypass vulnerability where lower-privilege staff users can ... |
| CVE-2026-103272 | HIGH | 7.5 | — | Oct 1, 2026 | Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauth... |
| CVE-2026-103271 | HIGH | 7.5 | 0.4% | Oct 1, 2026 | Ghost versions from 4.0.0 before 6.63.0 contain a content API vulnerability that allows unauthenticated visitors to acce... |
| CVE-2026-103269 | MEDIUM | 5.3 | — | Oct 1, 2026 | Ghost versions 5.3.0 before 6.62.0 contain a missing authorization vulnerability that allows an authenticated site membe... |
| CVE-2026-103268 | HIGH | 8.8 | — | Oct 1, 2026 | Ghost versions before 6.62.0 contain an authentication bypass vulnerability that allows suspended staff users to reactiv... |
| CVE-2026-103267 | MEDIUM | 4.3 | — | Oct 1, 2026 | Ghost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users... |
| CVE-2026-103266 | HIGH | 7.1 | 0.3% | Oct 1, 2026 | Ghost versions 5.2.0 through versions prior to 6.62.0 allow a remote attacker, without authentication, to abuse the Stri... |
| CVE-2026-103265 | MEDIUM | 4.3 | 0.2% | Oct 1, 2026 | Fleet versions before 4.89.0 fail to properly filter MDM command results by team authorization in the commands/results e... |
| CVE-2026-103264 | CRITICAL | 9.1 | 0.3% | Oct 1, 2026 | Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and... |
| CVE-2026-103263 | MEDIUM | 5.9 | — | Oct 1, 2026 | Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the... |
| CVE-2026-103262 | HIGH | 7.5 | 0.5% | Oct 1, 2026 | Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows ... |
| CVE-2026-103261 | MEDIUM | 5.3 | — | Oct 1, 2026 | Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.__init__, allowing remote att... |
| CVE-2026-103260 | MEDIUM | 4 | — | Oct 1, 2026 | n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an approval bypass vulnerability in the Send and Wait node's... |
| CVE-2026-103259 | HIGH | 7.6 | — | Oct 1, 2026 | n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a session token leakage vulnerability in the Dynamic Credent... |
| CVE-2026-103258 | MEDIUM | 6.8 | 0.3% | Oct 1, 2026 | n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an unescaped parameter interpolation vulnerability in SendGr... |