{"vulnerability": "CVE-2026-22594", "sightings": [{"uuid": "84e05cbb-5bab-4ae1-b677-348c312c8846", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22594", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mc22nlkmkt2z", "content": "", "creation_timestamp": "2026-01-10T03:22:35.032222Z"}, {"uuid": "36209d02-f561-4a50-9875-8441fa3bf28e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22594", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mc22obo6f52p", "content": "", "creation_timestamp": "2026-01-10T03:22:57.790734Z"}, {"uuid": "ec0338b2-37e9-4e7e-9209-9f4f3f1683e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22594", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mc264f3h2q2y", "content": "", "creation_timestamp": "2026-01-10T04:24:31.961459Z"}, {"uuid": "b7cfc159-d0f6-4fe7-a06a-6a620b0e29bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22594", "type": "seen", "source": "https://gist.github.com/Darkcrai86/e6a4ee20b7d126c2ce8920b8a1cae0cb", "content": "", "creation_timestamp": "2026-01-12T08:38:51.000000Z"}, {"uuid": "12733e73-f565-4e9f-ba4e-397b767f36f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22594", "type": "published-proof-of-concept", "source": "Telegram/xCOXvC0nHIdc2RZU8QnHf4AhOuGrMPNqhpiQVHQJKZvyIjM", "content": "", "creation_timestamp": "2026-01-10T04:02:47.000000Z"}, {"uuid": "f2e19640-3251-4c86-ac20-5c272a637a0d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-22594", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/ghostcms_auth_rce_cve_2026_29053.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Maksim Rogov\", \"Cristian-Alexandru Staicu\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a Remote Code Execution (RCE) vulnerability in Ghost CMS.\\n          Specifically crafted malicious themes can execute arbitrary code on the server running Ghost.\\n\\n          The affected versions include all releases from 0.7.2 up to and including 6.19.0.\\n          For versions 5.105.0-5.130.5 and 6.0.0-6.10.3, the module also leverages a 2FA bypass.\", \"disclosure_date\": \"2026-03-02\", \"fullname\": \"exploit/multi/http/ghostcms_auth_rce_cve_2026_29053\", \"is_install_path\": true, \"mod_time\": \"2026-08-07 05:21:48 +0000\", \"name\": \"Ghost CMS Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/ghostcms_auth_rce_cve_2026_29053.rb\", \"platform\": \"Linux,Unix,Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/ghostcms_auth_rce_cve_2026_29053\", \"references\": [\"CVE-2026-29053\", \"CVE-2026-22594\", \"URL-https://www.endorlabs.com/learn/rce-in-ghost-cms-ghsa-cgc2-rcrh-qr5x\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Ghost >= 0.7.2, <= 6.19.0 / Unix payload\", \"Ghost >= 0.7.2, <= 6.19.0 / Windows payload\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-08-10T10:02:09.358493Z"}]}