GI
Vendor
Gitroom
7
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-42556 | PO Postiz Gitroom | 9.0 | May 8 | Postiz stored XSS in public preview page |
| CVE-2026-42298 | PO Postiz Gitroom | 9.8 | May 8 | Postiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev |
| CVE-2026-40487 | PO Postiz Gitroom | 9.0 | Apr 18 | Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS |
| CVE-2026-40168 | PO Postiz Gitroom | 8.2 | Apr 10 | Postiz has Server-Side Request Forgery via Redirect Bypass in /api/public/stream |
| CVE-2026-34590 | PO Postiz Gitroom | 5.4 | Apr 2 | Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation |
| CVE-2026-34577 | PO Postiz Gitroom | 8.6 | Apr 2 | Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check |
| CVE-2026-34576 | PO Postiz Gitroom | 7.7 | Apr 2 | Postiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata |