Suggestions search

All statuses

Filter by:

With package: ghostfolio

Found 12 matching suggestions

View:

Compact

Detailed

Untriaged

Permalink CVE-2026-53945

4.0 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

created 3 weeks ago Activity log

Created suggestion 3 weeks ago

Ghost: Server-side request forgery via DNS rebinding in external request handling

Ghost is a Node.js content management system. From 6.0.9 until 6.21.1, Ghost’s private-IP check for outbound HTTP requests could be bypassed via DNS rebinding, allowing an attacker to coerce the Ghost server into reaching hosts on internal networks through features that issue external fetches. This vulnerability is fixed in 6.21.1.

References

https://github.com/TryGhost/Ghost/security/advisories/GHSA-ch52-px8q-f22j x_refsource_CONFIRM

Affected products

Ghost

==>= 6.0.9, < 6.21.1

Matching in nixpkgs

pkgs.ghost

Android post-exploitation framework

nixos-unstable 8.0.0-unstable-2025-11-01
- nixpkgs-unstable 8.0.0-unstable-2025-11-01
- nixos-unstable-small 8.0.0-unstable-2025-11-01
nixos-26.05 8.0.0-unstable-2025-11-01
- nixos-26.05-small 8.0.0-unstable-2025-11-01
- nixpkgs-26.05-darwin 8.0.0-unstable-2025-11-01

pkgs.ghostie

Github notifications in your terminal

nixos-unstable 0.3.1
- nixpkgs-unstable 0.3.1
- nixos-unstable-small 0.3.1
nixos-26.05 0.3.1
- nixos-26.05-small 0.3.1
- nixpkgs-26.05-darwin 0.3.1

pkgs.ghostty

Fast, native, feature-rich terminal emulator pushing modern features

nixos-unstable 1.3.1
- nixpkgs-unstable 1.3.1
- nixos-unstable-small 1.3.1
nixos-26.05 1.3.1
- nixos-26.05-small 1.3.1
- nixpkgs-26.05-darwin 1.3.1

pkgs.ghost-cli

CLI Tool for installing & updating Ghost

nixos-unstable 1.28.6
- nixpkgs-unstable 1.28.6
- nixos-unstable-small 1.28.6
nixos-26.05 1.28.6
- nixos-26.05-small 1.28.6
- nixpkgs-26.05-darwin 1.28.6

pkgs.ghostfolio

Open Source Wealth Management Software

nixos-unstable 2.254.0
- nixpkgs-unstable 2.254.0
- nixos-unstable-small 2.254.0
nixos-26.05 2.254.0
- nixos-26.05-small 2.254.0
- nixpkgs-26.05-darwin 2.254.0

pkgs.ghostunnel

TLS proxy with mutual authentication support for securing non-TLS backend applications

nixos-unstable 1.8.4
- nixpkgs-unstable 1.8.4
- nixos-unstable-small 1.8.4
nixos-26.05 1.8.4
- nixos-26.05-small 1.8.4
- nixpkgs-26.05-darwin 1.8.4

pkgs.ghostscript

PostScript interpreter (mainline version)

nixos-unstable 10.07.0
- nixpkgs-unstable 10.07.0
- nixos-unstable-small 10.07.0
nixos-26.05 10.07.0
- nixos-26.05-small 10.07.0
- nixpkgs-26.05-darwin 10.07.0

pkgs.ghosttohugo

Convert Ghost export to Hugo posts

nixos-unstable 0.5.3
- nixpkgs-unstable 0.5.3
- nixos-unstable-small 0.5.3
nixos-26.05 0.5.3
- nixos-26.05-small 0.5.3
- nixpkgs-26.05-darwin 0.5.3

pkgs.ghostty-bin

Fast, native, feature-rich terminal emulator pushing modern features

nixos-unstable 1.3.1
- nixpkgs-unstable 1.3.1
- nixos-unstable-small 1.3.1
nixos-26.05 1.3.1
- nixos-26.05-small 1.3.1
- nixpkgs-26.05-darwin 1.3.1

pkgs.ghostscriptX

PostScript interpreter (mainline version)

nixos-unstable 10.07.0
- nixpkgs-unstable 10.07.0
- nixos-unstable-small 10.07.0
nixos-26.05 10.07.0
- nixos-26.05-small 10.07.0
- nixpkgs-26.05-darwin 10.07.0

pkgs.libghostty-vt

Ghostty's VT (terminal sequence) parsing library

nixos-unstable 0.1.0-unstable-2026-05-03
- nixpkgs-unstable 0.1.0-unstable-2026-05-03
- nixos-unstable-small 0.1.0-unstable-2026-05-03
nixos-26.05 0.1.0-unstable-2026-05-03
- nixos-26.05-small 0.1.0-unstable-2026-05-03
- nixpkgs-26.05-darwin 0.1.0-unstable-2026-05-03

pkgs.ghost-complete

Terminal-native autocomplete engine using PTY proxying for macOS terminals

nixos-unstable 0.16.0
- nixpkgs-unstable 0.9.1
- nixos-unstable-small 0.16.0
nixos-26.05 0.9.1
- nixos-26.05-small 0.9.1
- nixpkgs-26.05-darwin 0.9.1

pkgs.ghostscript_headless

PostScript interpreter (mainline version)

nixos-unstable 10.07.0
- nixpkgs-unstable 10.07.0
- nixos-unstable-small 10.07.0
nixos-26.05 10.07.0
- nixos-26.05-small 10.07.0
- nixpkgs-26.05-darwin 10.07.0

pkgs.kdePackages.ghostwriter

Text editor for Markdown

nixos-unstable 26.04.2
- nixpkgs-unstable 26.04.1
- nixos-unstable-small 26.04.2
nixos-26.05 26.04.2
- nixos-26.05-small 26.04.2
- nixpkgs-26.05-darwin 26.04.2

pkgs.python313Packages.aioghost

Async Python client for the Ghost Admin API

nixos-unstable 0.4.16
- nixpkgs-unstable 0.4.16
- nixos-unstable-small 0.4.16
nixos-26.05 0.4.16
- nixos-26.05-small 0.4.16
- nixpkgs-26.05-darwin 0.4.16

pkgs.python314Packages.aioghost

Async Python client for the Ghost Admin API

nixos-unstable 0.4.16
- nixpkgs-unstable 0.4.16
- nixos-unstable-small 0.4.16
nixos-26.05 0.4.16
- nixos-26.05-small 0.4.16
- nixpkgs-26.05-darwin 0.4.16

pkgs.haskellPackages.ghost-buster

Existential type utilites

nixos-unstable 0.1.1.0
- nixpkgs-unstable 0.1.1.0
- nixos-unstable-small 0.1.1.0
nixos-26.05 0.1.1.0
- nixos-26.05-small 0.1.1.0
- nixpkgs-26.05-darwin 0.1.1.0

pkgs.python312Packages.ghostscript

None

pkgs.python313Packages.ghostscript

Interface to the Ghostscript C-API using ctypes

nixos-unstable 0.7
- nixpkgs-unstable 0.7
- nixos-unstable-small 0.7
nixos-26.05 0.7
- nixos-26.05-small 0.7
- nixpkgs-26.05-darwin 0.7

pkgs.python314Packages.ghostscript

Interface to the Ghostscript C-API using ctypes

nixos-unstable 0.7
- nixpkgs-unstable 0.7
- nixos-unstable-small 0.7
nixos-26.05 0.7
- nixos-26.05-small 0.7
- nixpkgs-26.05-darwin 0.7

pkgs.haskellPackages.ghostscript-parallel

Let Ghostscript render pages in parallel

nixos-unstable 0.0.1
- nixpkgs-unstable 0.0.1
- nixos-unstable-small 0.0.1
nixos-26.05 0.0.1
- nixos-26.05-small 0.0.1
- nixpkgs-26.05-darwin 0.0.1

pkgs.tree-sitter-grammars.tree-sitter-ghostty

Tree-sitter grammar for ghostty

nixos-unstable 1.3.0-unstable-2026-04-24
- nixpkgs-unstable 1.3.0-unstable-2026-04-24
- nixos-unstable-small 1.3.1-unstable-2026-06-03
nixos-26.05 1.3.0-unstable-2026-04-24
- nixos-26.05-small 1.3.0-unstable-2026-04-24
- nixpkgs-26.05-darwin 1.3.0-unstable-2026-04-24

pkgs.python313Packages.tree-sitter-grammars.tree-sitter-ghostty

Python bindings for tree-sitter-ghostty

nixos-unstable 1.3.0+unstable20260424
- nixpkgs-unstable 1.3.0+unstable20260424
- nixos-unstable-small 1.3.1+unstable20260603
nixos-26.05 1.3.0+unstable20260424
- nixos-26.05-small 1.3.0+unstable20260424
- nixpkgs-26.05-darwin 1.3.0+unstable20260424

pkgs.python314Packages.tree-sitter-grammars.tree-sitter-ghostty

Python bindings for tree-sitter-ghostty

nixos-unstable 1.3.0+unstable20260424
- nixpkgs-unstable 1.3.0+unstable20260424
- nixos-unstable-small 1.3.1+unstable20260603
nixos-26.05 1.3.0+unstable20260424
- nixos-26.05-small 1.3.0+unstable20260424
- nixpkgs-26.05-darwin 1.3.0+unstable20260424

Package maintainers

@fabaff Fabian Affolter <mail@fabian-affolter.ch>
@cything cy <nix@cything.io>
@Moraxyc Moraxyc Xu <i@qaq.li>
@matthiasbeyer Matthias Beyer <mail@beyermatthias.de>
@tobim Tobias Mayer <nix@tobim.fastmail.fm>
@clerie clerie <nix@clerie.de>
@pluiedev Leah Amelia Chen <hi@pluie.me>
@jcollie Jeffrey C. Ollie <jeff@ocjtech.us>
@getchoo Seth Flynn <getchoo@tuta.io>
@Enzime Michael Hoang
@mjm Matt Moriarity <matt@mattmoriarity.com>
@roberth Robert Hensing <nixpkgs@roberthensing.nl>
@K900 Ilya K. <me@0upti.me>
@ttuegel Thomas Tuegel <ttuegel@mailbox.org>
@nyanloutre Paul Trehiou <paul@nyanlout.re>
@FRidh Frederik Rietdijk <fridh@fridh.nl>
@ilya-fedin Ilya Fedin <fedin-ilja2010@ya.ru>
@peterhoeg Peter Hoeg <peter@hoeg.com>
@NickCao Nick Cao <nickcao@nichi.co>
@bkchr Bastian Köcher <nixos@kchr.de>
@LunNova Luna Nova <nixpkgs-maintainer@lunnova.dev>
@SuperSandro2000 Sandro Jäckel <sandro.jaeckel@gmail.com>
@flokli Florian Klink <flokli@flokli.de>
@imcvampire Quoc-Anh Nguyen
@domenkozar Domen Kozar <domen@dev.si>
@JamieMagee Jamie Magee <jamie.magee@gmail.com>
@adfaure Adrien Faure <adfaure@pm.me>
@stepbrobd Yifei Sun <ysun@hey.com>
@A-jay98 Ali Jamadi <ali@jamadi.me>
@mightyiam Shahar "Dawn" Or <mightyiampresence@gmail.com>
@aciceri Andrea Ciceri <andrea.ciceri@autistici.org>

Dismissed

(exclusively hosted service)

Permalink CVE-2026-26365

4.0 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): Low (L)
Modified Availability (MA): None (N)

updated 4 months, 1 week ago by @ADMIN Activity log

Created suggestion 4 months, 3 weeks ago
@ADMIN dismissed 4 months, 1 week ago

Akamai Ghost on Akamai CDN edge servers before 2026-02-06 mishandles …

Akamai Ghost on Akamai CDN edge servers before 2026-02-06 mishandles processing of custom hop-by-hop HTTP headers, where an incoming request containing the header "Connection: Transfer-Encoding" could result in a forward request with invalid message framing, depending on the Akamai processing path. This could result in the origin server parsing the request body incorrectly, leading to HTTP request smuggling.