Ghost CMS
Ghost's September Patch Run: 43 Advisories, One RCE, and the Admin Plumbing That Carries Them
Ghost shipped six releases between September 15 and September 29, a 15-day span, to close a cluster of 54 NVD records. The remote code execution is the headline, but the authentication bypasses are where a self-hosted install actually bleeds.