Login Request a demo
PO
Product
Postiz
by Gitroom · last CVE May 8, 2026
7
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities7In the news0Timeline
Severity mix
Critical 3High 3Medium 1Low 0
Severity
All severities7Critical3High3Medium1Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Postiz to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-42298
9.8
1%
May 8
Postiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev
Affected: before 2.21.7
CVE-2026-42556
9.0
0%
May 8
Postiz stored XSS in public preview page
Affected: 2.21.6
CVE-2026-40487
9.0
0%
Apr 18
Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS
Affected: before 2.21.6
CVE-2026-34577
8.6
0%
Apr 2
Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check
Affected: before 2.21.3
CVE-2026-40168
8.2
0%
Apr 10
Postiz has Server-Side Request Forgery via Redirect Bypass in /api/public/stream
Affected: before 2.21.5
CVE-2026-34576
7.7
0%
Apr 2
Postiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata
Affected: before 2.21.3
CVE-2026-34590
5.4
0%
Apr 2
Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation
Affected: before 2.21.4
Showing 7