gitroom kayıtları
gitroom üreticisine ait 7 yayımlanmış kayıt.
Araştırmacı profili
- KEV’e giren
- 0 · %0
- Silahlaştırılmış
- 0 · %0
- Pre-auth RCE
- 1
- Düzeltme kaydı olan
- %57,1
- Yayından KEV’e ortanca
- KEV’e giren kayıt yok
Tekrar eden sınıflar
- CWE-918 Server-Side Request Forgery (SSRF)4
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')2
- CWE-94 Improper Control of Generation of Code ('Code Injection')1
Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.
CWESaldırı profili
Tüm kayıtlar
7 kayıt| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
39İzleyin | CVE-2026-42298Kavram kanıtı | Postiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.devgitroom · postiz · CWE-94 | Kritik9,8 | — | %0,8 | 8 May 2026 |
36İzleyin | CVE-2026-42556İstismar yok | Postiz stored XSS in public preview pagegitroom · postiz · CWE-79 | Kritik9,0 | — | %0,4 | 8 May 2026 |
36İzleyin | CVE-2026-40487Kavram kanıtı | Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSSgitroom · postiz · CWE-79 | Kritik9,0 | — | %0,3 | 17 Nis 2026 |
34İzleyin | CVE-2026-34577İstismar yok | Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Checkgitroom · postiz · CWE-918 | Yüksek8,6 | — | %0,5 | 2 Nis 2026 |
33İzleyin | CVE-2026-34576İstismar yok | Postiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadatagitroom · postiz · CWE-918 | Yüksek8,3 | — | %0,4 | 2 Nis 2026 |
32İzleyin | CVE-2026-40168İstismar yok | Postiz has Server-Side Request Forgery via Redirect Bypass in /api/public/streamgitroom · postiz · CWE-918 | Yüksek8,2 | — | %0,5 | 10 Nis 2026 |
21İzleyin | CVE-2026-34590İstismar yok | Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validationgitroom · postiz · CWE-918 | Orta5,4 | — | %0,3 | 2 Nis 2026 |
- CVE-2026-4229839İzleyin
Postiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev
KritikCVSS 9,8Kavram kanıtıEPSS %1gitroom · postiz8 May 2026
- CVE-2026-4255636İzleyin
Postiz stored XSS in public preview page
KritikCVSS 9,0İstismar yokEPSS %0gitroom · postiz8 May 2026
- CVE-2026-4048736İzleyin
Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS
KritikCVSS 9,0Kavram kanıtıEPSS %0gitroom · postiz17 Nis 2026
- CVE-2026-3457734İzleyin
Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check
YüksekCVSS 8,6İstismar yokEPSS %1gitroom · postiz2 Nis 2026
- CVE-2026-3457633İzleyin
Postiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata
YüksekCVSS 8,3İstismar yokEPSS %0gitroom · postiz2 Nis 2026
- CVE-2026-4016832İzleyin
Postiz has Server-Side Request Forgery via Redirect Bypass in /api/public/stream
YüksekCVSS 8,2İstismar yokEPSS %1gitroom · postiz10 Nis 2026
- CVE-2026-3459021İzleyin
Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation
OrtaCVSS 5,4İstismar yokEPSS %0gitroom · postiz2 Nis 2026