Login Request a demo
PO
Product
postiz-app
by gitroomhq · last CVE Oct 24, 2026
19
CVEs
0
On KEV
9.9
Max CVSS
4
New 30D
Vulnerabilities19In the news0Timeline
Severity mix
Critical 9High 5Medium 5Low 0
Severity
All severities19Critical9High5Medium5Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add postiz-app to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-19127
6.5
0%
Aug 6
Insufficient verification of lifetime-deal redemption codes allows forgery of permanent paid subscriptions
Affected: before 2.21.10
CVE-2026-42346
6.5
0%
May 8
Postiz: TOCTOU DNS rebinding bypasses all SSRF URL validation paths
Affected: >= 2.16.6, < 2.21.7
CVE-2026-34590
5.4
0%
Apr 2
Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation
Affected: < 2.21.4
CVE-2026-107761
5.3
0%
Oct 11
Channel tokens and organization API key exposed in API responses
Affected: before 2.25.1
CVE-2026-48783
4.8
0%
Jun 16
Postiz has an unauthenticated billing-enforcement bypass via /public/modify-subscription
Affected: < 2.21.8
Showing 5