postiz: CVE Program partner

CVEs, 365 days55 all time, 0 rejected

Quality100%median 99%

CVSS by the CNA100%share of records

CWE100%share of records

Affected versions100%not n/a or unspecified

CVSS added by CISA0%lower is better

Organisation	Postiz
Role	CNA
Type	Vendor, Open Source, Hosted Service
Reports to	mitre
Scope	Postiz products and projects only including: the core repository for postiz-app (github.com/gitroomhq/postiz-app); all gitroomhq repositories that are official components, tooling, or integrations of Postiz; official Postiz container images published under gitroomhq on GHCR; official Postiz CLI tools and NPM packages (NPM org: @postiz); Postiz-Cloud related infrastructure and services. (API, Frontend, Configurations etc.); and plugins for Postiz maintained within the gitroomhq organization.
Advisories	https://postiz.gadvisory.org/advisories

CVE-2026-107761 2026-10-11 · CVSS 5.3
Several Postiz endpoints return the complete database row of the record they operate on instead of only the fields the client needs. Two of them include secrets
CVE-2026-94455 2026-09-22 · CVSS 7.1
An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only t
CVE-2026-94456 2026-09-22 · CVSS 9.1
Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source. The same helper is used for OAuth access tok
CVE-2026-19264 2026-08-07 · CVSS 9.8
Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and
CVE-2026-19127 2026-08-06 · CVSS 6.5
An issue in the billing and license activation subsystem allows remote attackers to bypass payment authorization workflows. By exploiting insufficient cryptogra

postiz