CVE-2026-105645

MediumCVSS 4.9/10Last modified Oct 6, 2026

Description

Ghost is a Node.js content management system. From 5.37.0 until 6.67.0, a crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1333

Affected software

No affected versions have been published.

Timeline

Published: Oct 5, 2026
Last modified: Oct 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1056464.9Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, a crafted content import file could cause excessive CPU usage, making CVE-2026-1056474.0Ghost is a Node.js content management system. From 6.54.1 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, CVE-2026-1056484.0Ghost is a Node.js content management system. From 6.0.9 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, t CVE-2026-1056497.3Ghost is a Node.js content management system. From 4.22.0 until 6.65.0, SVG media thumbnails and SVG images uploaded with a non-SVG file ext CVE-2026-105653.1A security flaw has been discovered in Open5GS up to 2.7.6. The impacted element is the function gmm_state_security_mode of the file src/amf CVE-2026-1056508.1Ghost is a Node.js content management system. From 2.1.0 until 6.64.0, embedding a URL from an attacker-controlled website could result in u CVE-2026-1056517.3Ghost is a Node.js content management system. From 5.94.0 until 6.64.0, when creating a bookmark card, Ghost could store non-image files fet CVE-2026-1056523.1Ghost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determine the relative ordering of o CVE-2026-1056598.7Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes i CVE-2026-105665.3A weakness has been identified in FoundationAgents MetaGPT up to 0.8.2. This affects the function Message.check_instruct_content of the file CVE-2026-1056606.9Improper Validation of Syntactic Correctness of Input vulnerability in mtrudel bandit allows an unauthenticated remote attacker to set conn.CVE-2026-1056615.3Requesting `/{username}/-/repositories` for an individual user instead of an organization made the organization home handler dereference a n