agentprime: gitroomhq-postiz-appEvery new CVE for gitroomhq-postiz-app.https://agentprime.io/CVE-2026-115933: Forged signed tokens let any registered user take over other users and organizationshttps://agentprime.io/advisories/CVE-2026-115933/https://agentprime.io/advisories/CVE-2026-115933/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Sat, 24 Oct 2026 14:17:05 GMTCVEcriticalCVE-2026-115932: Path traversal in post media lets any registered user read server fileshttps://agentprime.io/advisories/CVE-2026-115932/https://agentprime.io/advisories/CVE-2026-115932/CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Sat, 24 Oct 2026 12:28:36 GMTCVEcriticalCVE-2026-115931: Arbitrary file read and backend crash through unrestricted provider method callshttps://agentprime.io/advisories/CVE-2026-115931/https://agentprime.io/advisories/CVE-2026-115931/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 22:02:21 GMTCVEcriticalCVE-2026-107761: Channel tokens and organization API key exposed in API responseshttps://agentprime.io/advisories/CVE-2026-107761/https://agentprime.io/advisories/CVE-2026-107761/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 11 Oct 2026 15:23:15 GMTCVECVE-2026-94455: Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API keyhttps://agentprime.io/advisories/CVE-2026-94455/https://agentprime.io/advisories/CVE-2026-94455/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 22 Sep 2026 16:17:00 GMTCVECVE-2026-94456: Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keyshttps://agentprime.io/advisories/CVE-2026-94456/https://agentprime.io/advisories/CVE-2026-94456/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 22 Sep 2026 16:11:33 GMTCVEcriticalCVE-2026-19264: Unauthenticated arbitrary file read via /uploads path traversal (URL-encoded separators) leading to instance takeoverhttps://agentprime.io/advisories/CVE-2026-19264/https://agentprime.io/advisories/CVE-2026-19264/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 07 Aug 2026 14:15:15 GMTCVEcriticalCVE-2026-19127: Insufficient verification of lifetime-deal redemption codes allows forgery of permanent paid subscriptionshttps://agentprime.io/advisories/CVE-2026-19127/https://agentprime.io/advisories/CVE-2026-19127/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 17:02:44 GMTCVECVE-2026-48799: Postiz: Unauthenticated arbitrary lifetime PRO grant via Nowpayments webhookhttps://agentprime.io/advisories/CVE-2026-48799/https://agentprime.io/advisories/CVE-2026-48799/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 15 Jul 2026 16:11:24 GMTCVECVE-2026-48783: Postiz has an unauthenticated billing-enforcement bypass via /public/modify-subscriptionhttps://agentprime.io/advisories/CVE-2026-48783/https://agentprime.io/advisories/CVE-2026-48783/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 16 Jun 2026 21:38:00 GMTCVECVE-2026-48781: Postiz has cross-tenant SUPERADMIN takeover via Skool-provider JWT forgeryhttps://agentprime.io/advisories/CVE-2026-48781/https://agentprime.io/advisories/CVE-2026-48781/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 16 Jun 2026 21:31:28 GMTCVEcriticalCVE-2026-42556: Postiz stored XSS in public preview pagehttps://agentprime.io/advisories/CVE-2026-42556/https://agentprime.io/advisories/CVE-2026-42556/CVSS 8.9 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 08 May 2026 22:28:33 GMTCVECVE-2026-42346: Postiz: TOCTOU DNS rebinding bypasses all SSRF URL validation pathshttps://agentprime.io/advisories/CVE-2026-42346/https://agentprime.io/advisories/CVE-2026-42346/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 08 May 2026 22:26:50 GMTCVECVE-2026-42298: Postiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.devhttps://agentprime.io/advisories/CVE-2026-42298/https://agentprime.io/advisories/CVE-2026-42298/CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 08 May 2026 22:24:10 GMTCVEcriticalCVE-2026-40487: Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSShttps://agentprime.io/advisories/CVE-2026-40487/https://agentprime.io/advisories/CVE-2026-40487/CVSS 8.9 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 18 Apr 2026 01:19:06 GMTCVECVE-2026-40168: Postiz has Server-Side Request Forgery via Redirect Bypass in /api/public/streamhttps://agentprime.io/advisories/CVE-2026-40168/https://agentprime.io/advisories/CVE-2026-40168/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Apr 2026 19:20:16 GMTCVECVE-2026-34590: Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validationhttps://agentprime.io/advisories/CVE-2026-34590/https://agentprime.io/advisories/CVE-2026-34590/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 02 Apr 2026 17:26:58 GMTCVECVE-2026-34577: Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Checkhttps://agentprime.io/advisories/CVE-2026-34577/https://agentprime.io/advisories/CVE-2026-34577/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 02 Apr 2026 17:24:33 GMTCVECVE-2026-34576: Postiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadatahttps://agentprime.io/advisories/CVE-2026-34576/https://agentprime.io/advisories/CVE-2026-34576/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 02 Apr 2026 17:23:14 GMTCVECVE-2025-53641: Postiz allows header mutation in middleware facilitates resulting in SSRFhttps://agentprime.io/advisories/CVE-2025-53641/https://agentprime.io/advisories/CVE-2025-53641/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 11 Jul 2025 17:28:20 GMTCVE