Login Request a demo
PO
Product
postiz-app
by gitroomhq · last CVE Oct 24, 2026
19
CVEs
0
On KEV
9.9
Max CVSS
4
New 30D
Vulnerabilities19In the news0Timeline
Severity mix
Critical 9High 5Medium 5Low 0
Severity
All severities19Critical9High5Medium5Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add postiz-app to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-34577
8.6
0%
Apr 2
Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check
Affected: < 2.21.3
CVE-2026-40168
8.2
0%
Apr 10
Postiz has Server-Side Request Forgery via Redirect Bypass in /api/public/stream
Affected: < 2.21.5
CVE-2026-48799
7.7
0%
Jul 15
Postiz: Unauthenticated arbitrary lifetime PRO grant via Nowpayments webhook
Affected: < 2.21.8
CVE-2026-34576
7.7
0%
Apr 2
Postiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata
Affected: < 2.21.3
CVE-2026-94455
7.1
0%
Sep 22
Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key
Affected: before 2.4.0
Showing 5