https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Wed, 05 Aug 2026 09:51:57 +0000 https://vulnerability.circl.lu/sighting/d50a17e0-73eb-42cc-9b8d-797880afc632/export {"uuid": "d50a17e0-73eb-42cc-9b8d-797880afc632", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-chgm-3698-jm42", "type": "seen", "source": "https://gist.github.com/alon710/c4a761947b80459c983e02321c736c9a", "content": "# CVE-2026-53947: CVE-2026-53947: Observable Response Discrepancy (User Enumeration) in Ghost CMS\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-53947\n\n## Summary\nCVE-2026-53947 is an observable response discrepancy (CWE-204) in Ghost CMS that permits unauthenticated remote user enumeration via the passwordless magic link sign-in endpoint.\n\n## TL;DR\nGhost CMS versions 5.18.0 through 6.21.1 allow unauthenticated attackers to enumerate registered member email addresses due to distinct HTTP response codes and messages returned by the magic link sign-in endpoint. Upgrading to 6.21.1 mitigates this.\n\n## Technical Details\n\n- **CWE ID**: CWE-204 (Observable Response Discrepancy)\n- **Attack Vector**: Network (Remote, Unauthenticated)\n- **CVSS Score**: 5.3 (Medium)\n- **EPSS Score**: 0.00206 (Percentile: 10.84%)\n- **Impact**: User Enumeration\n- **Exploit Status**: None (No public weaponized exploit available)\n- **KEV Status**: Not Listed in CISA KEV\n\n## Affected Systems\n\n- Ghost CMS\n- **Ghost**: >= 5.18.0, < 6.21.1 (Fixed in: `6.21.1`)\n\n## Mitigation\n\n- Upgrade Ghost CMS to version 6.21.1 or higher.\n- Apply rate limiting on the `/members/api/send-magic-link` endpoint.\n- Implement WAF monitoring rules.\n\n**Remediation Steps:**\n1. Verify current Ghost version running in production.\n2. Update Ghost dependency to version 6.21.1 or newer.\n3. Redeploy the application and verify portal authentication functions.\n4. Configure IP-based rate limiting on reverse proxy for magic-link endpoints.\n5. Monitor log traffic to detect outstanding scanning signatures.\n\n## References\n\n- [Official Security Advisory](https://github.com/TryGhost/Ghost/security/advisories/GHSA-chgm-3698-jm42)\n- [Official Fix Commit](https://github.com/TryGhost/Ghost/commit/fb2bb634653d99de68fc42d415721d755284fe30)\n- [Pull Request](https://github.com/TryGhost/Ghost/pull/26752)\n- [Official Release](https://github.com/TryGhost/Ghost/releases/tag/v6.21.1)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-53947)\n- [NVD Vuln Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-53947)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-53947) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-05T00:00:39.583166Z"} {"uuid": "d50a17e0-73eb-42cc-9b8d-797880afc632", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-chgm-3698-jm42", "type": "seen", "source": "https://gist.github.com/alon710/c4a761947b80459c983e02321c736c9a", "content": "# CVE-2026-53947: CVE-2026-53947: Observable Response Discrepancy (User Enumeration) in Ghost CMS\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-53947\n\n## Summary\nCVE-2026-53947 is an observable response discrepancy (CWE-204) in Ghost CMS that permits unauthenticated remote user enumeration via the passwordless magic link sign-in endpoint.\n\n## TL;DR\nGhost CMS versions 5.18.0 through 6.21.1 allow unauthenticated attackers to enumerate registered member email addresses due to distinct HTTP response codes and messages returned by the magic link sign-in endpoint. Upgrading to 6.21.1 mitigates this.\n\n## Technical Details\n\n- **CWE ID**: CWE-204 (Observable Response Discrepancy)\n- **Attack Vector**: Network (Remote, Unauthenticated)\n- **CVSS Score**: 5.3 (Medium)\n- **EPSS Score**: 0.00206 (Percentile: 10.84%)\n- **Impact**: User Enumeration\n- **Exploit Status**: None (No public weaponized exploit available)\n- **KEV Status**: Not Listed in CISA KEV\n\n## Affected Systems\n\n- Ghost CMS\n- **Ghost**: >= 5.18.0, < 6.21.1 (Fixed in: `6.21.1`)\n\n## Mitigation\n\n- Upgrade Ghost CMS to version 6.21.1 or higher.\n- Apply rate limiting on the `/members/api/send-magic-link` endpoint.\n- Implement WAF monitoring rules.\n\n**Remediation Steps:**\n1. Verify current Ghost version running in production.\n2. Update Ghost dependency to version 6.21.1 or newer.\n3. Redeploy the application and verify portal authentication functions.\n4. Configure IP-based rate limiting on reverse proxy for magic-link endpoints.\n5. Monitor log traffic to detect outstanding scanning signatures.\n\n## References\n\n- [Official Security Advisory](https://github.com/TryGhost/Ghost/security/advisories/GHSA-chgm-3698-jm42)\n- [Official Fix Commit](https://github.com/TryGhost/Ghost/commit/fb2bb634653d99de68fc42d415721d755284fe30)\n- [Pull Request](https://github.com/TryGhost/Ghost/pull/26752)\n- [Official Release](https://github.com/TryGhost/Ghost/releases/tag/v6.21.1)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-53947)\n- [NVD Vuln Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-53947)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-53947) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-05T00:00:39.583166Z"} https://vulnerability.circl.lu/sighting/d50a17e0-73eb-42cc-9b8d-797880afc632/export Wed, 05 Aug 2026 00:00:39 +0000 https://vulnerability.circl.lu/sighting/ca784264-ec24-42b9-b1ae-aa574fd41bef/export {"uuid": "ca784264-ec24-42b9-b1ae-aa574fd41bef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-chgm-3698-jm42", "type": "seen", "source": "https://gist.github.com/alon710/c4a761947b80459c983e02321c736c9a", "content": "# CVE-2026-53947: CVE-2026-53947: Observable Response Discrepancy (User Enumeration) in Ghost CMS\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-53947\n\n## Summary\nCVE-2026-53947 is an observable response discrepancy (CWE-204) in Ghost CMS that permits unauthenticated remote user enumeration via the passwordless magic link sign-in endpoint.\n\n## TL;DR\nGhost CMS versions 5.18.0 through 6.21.1 allow unauthenticated attackers to enumerate registered member email addresses due to distinct HTTP response codes and messages returned by the magic link sign-in endpoint. Upgrading to 6.21.1 mitigates this.\n\n## Technical Details\n\n- **CWE ID**: CWE-204 (Observable Response Discrepancy)\n- **Attack Vector**: Network (Remote, Unauthenticated)\n- **CVSS Score**: 5.3 (Medium)\n- **EPSS Score**: 0.00206 (Percentile: 10.84%)\n- **Impact**: User Enumeration\n- **Exploit Status**: None (No public weaponized exploit available)\n- **KEV Status**: Not Listed in CISA KEV\n\n## Affected Systems\n\n- Ghost CMS\n- **Ghost**: >= 5.18.0, < 6.21.1 (Fixed in: `6.21.1`)\n\n## Mitigation\n\n- Upgrade Ghost CMS to version 6.21.1 or higher.\n- Apply rate limiting on the `/members/api/send-magic-link` endpoint.\n- Implement WAF monitoring rules.\n\n**Remediation Steps:**\n1. Verify current Ghost version running in production.\n2. Update Ghost dependency to version 6.21.1 or newer.\n3. Redeploy the application and verify portal authentication functions.\n4. Configure IP-based rate limiting on reverse proxy for magic-link endpoints.\n5. Monitor log traffic to detect outstanding scanning signatures.\n\n## References\n\n- [Official Security Advisory](https://github.com/TryGhost/Ghost/security/advisories/GHSA-chgm-3698-jm42)\n- [Official Fix Commit](https://github.com/TryGhost/Ghost/commit/fb2bb634653d99de68fc42d415721d755284fe30)\n- [Pull Request](https://github.com/TryGhost/Ghost/pull/26752)\n- [Official Release](https://github.com/TryGhost/Ghost/releases/tag/v6.21.1)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-53947)\n- [NVD Vuln Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-53947)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-53947) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T23:31:07.884835Z"} {"uuid": "ca784264-ec24-42b9-b1ae-aa574fd41bef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-chgm-3698-jm42", "type": "seen", "source": "https://gist.github.com/alon710/c4a761947b80459c983e02321c736c9a", "content": "# CVE-2026-53947: CVE-2026-53947: Observable Response Discrepancy (User Enumeration) in Ghost CMS\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-08-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-53947\n\n## Summary\nCVE-2026-53947 is an observable response discrepancy (CWE-204) in Ghost CMS that permits unauthenticated remote user enumeration via the passwordless magic link sign-in endpoint.\n\n## TL;DR\nGhost CMS versions 5.18.0 through 6.21.1 allow unauthenticated attackers to enumerate registered member email addresses due to distinct HTTP response codes and messages returned by the magic link sign-in endpoint. Upgrading to 6.21.1 mitigates this.\n\n## Technical Details\n\n- **CWE ID**: CWE-204 (Observable Response Discrepancy)\n- **Attack Vector**: Network (Remote, Unauthenticated)\n- **CVSS Score**: 5.3 (Medium)\n- **EPSS Score**: 0.00206 (Percentile: 10.84%)\n- **Impact**: User Enumeration\n- **Exploit Status**: None (No public weaponized exploit available)\n- **KEV Status**: Not Listed in CISA KEV\n\n## Affected Systems\n\n- Ghost CMS\n- **Ghost**: >= 5.18.0, < 6.21.1 (Fixed in: `6.21.1`)\n\n## Mitigation\n\n- Upgrade Ghost CMS to version 6.21.1 or higher.\n- Apply rate limiting on the `/members/api/send-magic-link` endpoint.\n- Implement WAF monitoring rules.\n\n**Remediation Steps:**\n1. Verify current Ghost version running in production.\n2. Update Ghost dependency to version 6.21.1 or newer.\n3. Redeploy the application and verify portal authentication functions.\n4. Configure IP-based rate limiting on reverse proxy for magic-link endpoints.\n5. Monitor log traffic to detect outstanding scanning signatures.\n\n## References\n\n- [Official Security Advisory](https://github.com/TryGhost/Ghost/security/advisories/GHSA-chgm-3698-jm42)\n- [Official Fix Commit](https://github.com/TryGhost/Ghost/commit/fb2bb634653d99de68fc42d415721d755284fe30)\n- [Pull Request](https://github.com/TryGhost/Ghost/pull/26752)\n- [Official Release](https://github.com/TryGhost/Ghost/releases/tag/v6.21.1)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-53947)\n- [NVD Vuln Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-53947)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-53947) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T23:31:07.884835Z"} https://vulnerability.circl.lu/sighting/ca784264-ec24-42b9-b1ae-aa574fd41bef/export Tue, 04 Aug 2026 23:31:07 +0000