https://vulnogram.org/ Most recent CVEs assigned by Postiz (postiz). https://vulnogram.org/seaview/icons/postiz.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-107761 https://vulnogram.org/CVE-2026-107761 Several Postiz endpoints return the complete database row of the record they operate on instead of only the fields the client needs. Two of them include secrets the caller is not meant to receive. The public API's channel delete returns the deleted i… Medium Sun, 11 Oct 2026 15:23:15 GMT https://vulnogram.org/CVE-2026-94455 https://vulnogram.org/CVE-2026-94455 An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so n… High Tue, 22 Sep 2026 16:17:00 GMT https://vulnogram.org/CVE-2026-94456 https://vulnogram.org/CVE-2026-94456 Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source. The same helper is used for OAuth access tokens, authorization codes, client secrets, organization API keys, and PKCE verifiers, meani… Critical Tue, 22 Sep 2026 16:11:33 GMT https://vulnogram.org/CVE-2026-19264 https://vulnogram.org/CVE-2026-19264 Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and streams the file without normalising the path or confining it to that directory, and the… Critical Fri, 07 Aug 2026 14:15:15 GMT https://vulnogram.org/CVE-2026-19127 https://vulnogram.org/CVE-2026-19127 An issue in the billing and license activation subsystem allows remote attackers to bypass payment authorization workflows. By exploiting insufficient cryptographic validation or lack of server-side state verification on promotional/lifetime-deal (LT… Medium Thu, 06 Aug 2026 17:02:44 GMT