Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

CVE detail

CVE-2026-26980

Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.

CVSS 9.4 · CriticalBuzz score 43.0

Buzz score

Why this CVE is surfacing

Buzz score total 43.0

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 23.0 · diversity 20.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Mention score
23.0
9 evidence mentions in the snapshot
Diversity score
20.0
5 sources across 4 categories
KEV score
0.0
No KEV entry observed
OTX score
0.0
0 OTX pulses
PoC score
0.0
0 repos · best confidence N/A
Best PoC traction
0
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
0
within the 30d window
Peak daily
0
highest bucket

Evidence

Source links by recency

Newest mentions first
9 source links · newest first
  • 1st June – Threat Intelligence ReportCheck Point Research

    en code scanning across the products. The release addresses vulnerabilities in Check Point security gateways, including CVE-2026-48131 and CVE-2026-48132. The vulnerabilities were not exploited in the wild. Check Point IPS provides protection against these threats ( IKE Unsigned Underflow (CVE-2026-48131), IKE Improper Length Validation (CVE-2026-48132

    vendorresearch.checkpoint.comJun 1, 2026, 2:43 PM
  • SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 99Security Affairs

    Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Ghost CMS Mass Compromised via CVE-2026-26980, Now Fueling ClickFix Attacks TrapDoor Crypto Stealer Supply Chain Attack Hits 34 Packages and Hundreds of Versions Across npm, PyPI, and Crates.io RemotePE: The Lazarus RAT that lives […]

    newssecurityaffairs.comMay 31, 2026, 2:53 PM
  • Security Affairs newsletter Round 579 by Pierluigi Paganini – INTERNATIONAL EDITIONSecurity Affairs

    A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. ShinyHunters Leaks Charter Communications Data, Potentially Impacting 5 Million Customers Signal Phishing Campaign Targets Journalists and […]

    newssecurityaffairs.comMay 31, 2026, 2:32 PM
  • Ghost CMS flaw abused to push ClickFix attacks on hundreds of sitesSecurity Affairs

    Attackers are exploiting the patched Ghost CMS flaw CVE-2026-26980, compromising over 700 unpatched sites, including universities. Threat actors are actively exploiting a security flaw, tracked as CVE-2026-26980, in Ghost CMS that was fixed months ago in real attacks against unpatched websites. According to Qianxin, the campaign has already affected more than 700 sites, including well-known organizations and […]

    newssecurityaffairs.comMay 25, 2026, 6:07 PM
  • Ghost CMS Vulnerability Exploited to Hack Over 700 WebsitesSecurityWeek

    Sites belonging to major universities such as Harvard and Oxford, as well as DuckDuckGo, have been compromised in the attack.

    newswww.securityweek.comMay 25, 2026, 1:27 PM
  • https://blog.xlab.qianxin.com/ghost-cms-page-poisoning-cve-2026-26980/blog.xlab.qianxin.com

    No excerpt available.

    referenceblog.xlab.qianxin.comFeb 20, 2026, 2:16 AM
  • https://github.com/TryGhost/Ghost/security/advisories/GHSA-w52v-v783-gw97github.com

    No excerpt available.

    Exploitgithub.comFeb 20, 2026, 2:16 AM
  • https://github.com/TryGhost/Ghost/releases/tag/v6.19.1github.com

    No excerpt available.

    Exploitgithub.comFeb 20, 2026, 2:16 AM
  • https://github.com/TryGhost/Ghost/commit/30868d632b2252b638bc8a4c8ebf73964592ed91github.com

    No excerpt available.

    Exploitgithub.comFeb 20, 2026, 2:16 AM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars
No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence
  • CVE-2026-22596

    Ghost is a Node.js content management system. In versions 5.90.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's /ghost/api/admin/members/events endpoint allo…

    CVSS 6.7 · Medium
    3 mentions
  • CVE-2026-71571

    Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda < 2.0.0-4.0.11 - Backend operators with permissions to access iCagenda coul…

    CVSS 8.6 · High
    1 mention
  • CVE-2026-67365

    Joomla Extension - icagenda.com - Unauthenticated SQL injection in iCagenda < 4.0.0-4.0.11 - Unauthenticated SQL injection in mod_icagenda_calendar (iCagenda), reachable via com_a…

    CVSS 9.2 · Critical
    1 mention
  • CVE-2026-17227

    IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper neutralization of special elements used in an SQ…

    CVSS 5.4 · Medium
    1 mention
  • CVE-2026-18403

    LimeSurvey Community Edition 7.0.5 contains an authenticated SQL injection vulnerability in the Central Participant Database (CPDB) workflow that copies survey participant tokens…

    CVSS 6.0 · Medium
    3 mentions
  • CVE-2026-73850

    Emlog is an open source website building system. In 2.6.20 and earlier, there is a SQL injection vulnerability in the queryDatabase function in ai.php.

    CVSS 8.6 · High
    1 mention