영향받는 버전 라인
알려진 취약점
| CVE | 제목 | 영향 버전 | CVSS | 악용 | EPSS | 공개일 |
|---|---|---|---|---|---|---|
| CVE-2026-115933 | Forged signed tokens let any registered user take over other users and organizations | ≥ 2.15.0 < 2.25.3 | 9.9 | — | 2026-10-24 | |
| CVE-2026-115932 | Path traversal in post media lets any registered user read server files | ≥ 2.23.0 < 2.25.3 | 9.6 | — | 2026-10-24 | |
| CVE-2026-115931 | Arbitrary file read and backend crash through unrestricted provider method calls | ≥ 2.23.0 < 2.25.2 | 9.9 | — | 2026-10-24 | |
| CVE-2026-107761 | Channel tokens and organization API key exposed in API responses | < 2.25.1 | 5.3 | — | 2026-10-12 | |
| CVE-2026-94455 | Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key | < 2.4.0 | 7.1 | — | 2026-09-23 | |
| CVE-2026-94456 | Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets a... | < 2.4.0 | 9.1 | — | 2026-09-23 | |
| CVE-2026-19264 | Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance t... | < 2.22.1 | 9.3 | — | 2026-08-07 | |
| CVE-2026-19127 | Insufficient verification of lifetime-deal redemption codes allows forgery of permanent paid subscriptions | < 2.21.10 | 6.5 | — | 2026-08-07 | |
| CVE-2026-48799 | Postiz: Unauthenticated arbitrary lifetime PRO grant via Nowpayments webhook | * | 7.7 | — | 2026-07-16 | |
| CVE-2026-48783 | Postiz has an unauthenticated billing-enforcement bypass via /public/modify-subscription | * | 4.8 | — | 2026-06-17 | |
| CVE-2026-48781 | Postiz has cross-tenant SUPERADMIN takeover via Skool-provider JWT forgery | * | 9.9 | — | 2026-06-17 | |
| CVE-2026-42346 | Postiz: TOCTOU DNS rebinding bypasses all SSRF URL validation paths | * | 6.5 | — | 2026-05-09 | |
| CVE-2026-42556 | Postiz stored XSS in public preview page | * = 2.21.6 | 9.0 | — | 2026-05-08 | |
| CVE-2026-42298 | Postiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev | * < 2.21.7 | 9.8 | — | 2026-05-08 | |
| CVE-2026-40487 | Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS | * < 2.21.6 | 9.0 | — | 2026-04-18 | |
| CVE-2026-40168 | Postiz has Server-Side Request Forgery via Redirect Bypass in /api/public/stream | * < 2.21.5 | 8.2 | — | 2026-04-10 | |
| CVE-2026-34577 | Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check | * < 2.21.3 | 8.6 | — | 2026-04-02 | |
| CVE-2026-34576 | Postiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata | * < 2.21.3 | 8.3 | — | 2026-04-02 | |
| CVE-2026-34590 | Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation | * < 2.21.4 | 5.4 | — | 2026-04-02 | |
| CVE-2025-53641 | Postiz allows header mutation in middleware facilitates resulting in SSRF | * | 8.2 | — | 2025-07-12 |
내 서버의 버전을 직접 추적하세요
InfraGuard 는 모든 서버에 설치된 소프트웨어 버전을 수집하고, 알려진 취약점이 있는 버전을 알려 줍니다. 자체 호스팅이라 데이터가 내 네트워크를 벗어나지 않습니다.
데이터: CVE List(CVE® Program), NVD, CISA KEV, FIRST EPSS(EPSS 는 https://www.first.org/epss 참고), endoflife.date. 소프트웨어 목록: awesome-selfhosted(CC BY-SA 3.0).