CVE-2026-26980

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Feb 20, 2026
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-269816.5OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture indus CVE-2026-269828.8Ghostty is a cross-platform terminal emulator. Ghostty allows control characters such as 0x03 (Ctrl+C) in pasted and dropped text. These can CVE-2026-269835.3ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the CVE-2026-269848.8LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neur CVE-2026-269856.5LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neur CVE-2026-269867.5FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `rail_window_free` dereferences a freed `xfAppWind CVE-2026-269876.1LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are vulnerable to Reflected XSS at CVE-2026-269889.1LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below contain an SQL Injection vulnerabil CVE-2026-269894.8LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below are affected by a Stored Cross-Site CVE-2026-26999.8Customer Managed ShareFile Storage Zones Controller (SZC) allows an unauthenticated attacker to access restricted configuration pages. This CVE-2026-269908.8LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below have a Time-Based Blind SQL Injecti CVE-2026-269914.8LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. In versions 26.1.1 and below, the device group name is not san