Gitroom - vulnerabilities (CVEs)

7 CVEs in 1 products, 0 in the last 30 days, newest from 2026-05-08.

Products

CVE-2026-42556 - CVSS 9 (critical), 2026-05-08: Postiz is an AI social media scheduling tool. From version 2.21.6 to before version 2.21.7, any authenticated user who can create a post can store arbitrary…
CVE-2026-42298 - CVSS 10 (critical), 2026-05-08: Postiz is an AI social media scheduling tool. Prior to commit da44801, a "Pwn Request" vulnerability in the Build and Publish PR Docker Image workflow…
CVE-2026-40487 - CVSS 9 (critical), 2026-04-18: Postiz is an AI social media scheduling tool. Prior to version 2.21.6, a file upload validation bypass allows any authenticated user to upload arbitrary HTML,…
CVE-2026-40168 - CVSS 8.2 (high), 2026-04-10: Postiz is an AI social media scheduling tool. Prior to 2.21.5, the /api/public/stream endpoint is vulnerable to SSRF. Although the application validates the…
CVE-2026-34590 - CVSS 5.4 (medium), 2026-04-02: Postiz is an AI social media scheduling tool. Prior to version 2.21.4, the POST /webhooks/ endpoint for creating webhooks uses WebhooksDto which validates the…
CVE-2026-34577 - CVSS 8.6 (high), 2026-04-02: Postiz is an AI social media scheduling tool. Prior to version 2.21.3, the GET /public/stream endpoint in PublicController accepts a user-supplied url query…
CVE-2026-34576 - CVSS 8.3 (high), 2026-04-02: Postiz is an AI social media scheduling tool. Prior to version 2.21.3, the POST /public/v1/upload-from-url endpoint accepts a user-supplied URL and fetches it…