CVE que afectan a 2.4
| CVE | Título | CVSS | Explotada | EPSS | Publicación |
|---|---|---|---|---|---|
| CVE-2026-42298 | Postiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev | 9.8 | — | 2026-05-08 | |
| CVE-2026-19264 | Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance t... | 9.3 | — | 2026-08-07 | |
| CVE-2026-40487 | Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS | 9.0 | — | 2026-04-18 | |
| CVE-2026-34577 | Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check | 8.6 | — | 2026-04-02 | |
| CVE-2026-34576 | Postiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata | 8.3 | — | 2026-04-02 | |
| CVE-2026-40168 | Postiz has Server-Side Request Forgery via Redirect Bypass in /api/public/stream | 8.2 | — | 2026-04-10 | |
| CVE-2026-19127 | Insufficient verification of lifetime-deal redemption codes allows forgery of permanent paid subscriptions | 6.5 | — | 2026-08-07 | |
| CVE-2026-34590 | Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation | 5.4 | — | 2026-04-02 | |
| CVE-2026-107761 | Channel tokens and organization API key exposed in API responses | 5.3 | — | 2026-10-12 |
Controla estas versiones en tus propios servidores
InfraGuard recopila las versiones de software instaladas en cada servidor y señala las que tienen vulnerabilidades conocidas. Autoalojado: nada sale de tu red.
Datos: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (consulta EPSS en https://www.first.org/epss), endoflife.date. Lista de software: awesome-selfhosted (CC BY-SA 3.0).