{"schema_version":1,"title":"GitroomHQ Postiz-App vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 5 vulnerabilities in GitroomHQ Postiz-App: 0 in the last 7 days and 5 in the last 90 days, 4 of them critical and 0 exploited in the wild. The most recent, CVE-2026-115933, was published on 24 October 2026. 3 vulnerabilities in the last four weeks, up 50% on the four before (2). 3 critical against 1.","url":"https://junglewise.ai/threats/technologies/postiz-app","json_url":"https://junglewise.ai/threats/technologies/postiz-app.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/postiz-app","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":0,"all_time":5,"critical":4,"exploited":0,"last_7_days":0,"last_30_days":3,"last_90_days":5,"last_365_days":5},"latest":[{"cve":"CVE-2026-115933","cvss":9.9,"slug":"cve-2026-115933-postiz-signs-its-session-invitation-and-password-reset-tokens","title":"GitroomHQ postiz-app token signature forgery","severity":"critical","exploited":false,"published_at":"2026-10-24T15:17:33.957+00:00","url":"https://junglewise.ai/threats/cve-2026-115933-postiz-signs-its-session-invitation-and-password-reset-tokens"},{"cve":"CVE-2026-115932","cvss":9.6,"slug":"cve-2026-115932-when-a-post-is-published-postiz-treats-a-media-path-that-is-not","title":"Postiz path traversal in post media processing","severity":"critical","exploited":false,"published_at":"2026-10-24T13:16:37.217+00:00","url":"https://junglewise.ai/threats/cve-2026-115932-when-a-post-is-published-postiz-treats-a-media-path-that-is-not"},{"cve":"CVE-2026-115931","cvss":9.9,"slug":"cve-2026-115931-postiz-lets-a-signed-in-user-ask-the-backend-to-run-a-function","title":"GitroomHQ Postiz arbitrary file read and denial of service","severity":"critical","exploited":false,"published_at":"2026-10-23T23:17:43.263+00:00","url":"https://junglewise.ai/threats/cve-2026-115931-postiz-lets-a-signed-in-user-ask-the-backend-to-run-a-function"},{"cve":"CVE-2026-107761","epss":0.0028,"slug":"cve-2026-107761-several-postiz-endpoints-return-the-complete-database-row-of-the","title":"Postiz information disclosure in API responses","severity":"info","exploited":false,"published_at":"2026-10-11T16:16:30.49+00:00","url":"https://junglewise.ai/threats/cve-2026-107761-several-postiz-endpoints-return-the-complete-database-row-of-the"},{"cve":"CVE-2026-94456","cvss":9.1,"epss":0.0052,"slug":"cve-2026-94456-postiz-generates-security-sensitive-credentials-using-math-random","title":"GitroomHQ Postiz insecure random source in credential generation","severity":"critical","exploited":false,"published_at":"2026-09-22T17:17:31.67+00:00","url":"https://junglewise.ai/threats/cve-2026-94456-postiz-generates-security-sensitive-credentials-using-math-random"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":1,"exploited":0,"vulnerabilities":1},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":3,"exploited":0,"vulnerabilities":3},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"GitroomHQ Postiz-App","slug":"postiz-app","vendor":{"hub":true,"name":"GitroomHQ","slug":"gitroomhq","url":"https://junglewise.ai/threats/vendors/gitroomhq"},"aliases":[],"category":"web-application","description":"Web application for scheduling and managing social media posts across multiple platforms.","url":"https://junglewise.ai/threats/technologies/postiz-app"},"most_severe":[{"cve":"CVE-2026-115933","cvss":9.9,"slug":"cve-2026-115933-postiz-signs-its-session-invitation-and-password-reset-tokens","title":"GitroomHQ postiz-app token signature forgery","severity":"critical","exploited":false,"published_at":"2026-10-24T15:17:33.957+00:00","url":"https://junglewise.ai/threats/cve-2026-115933-postiz-signs-its-session-invitation-and-password-reset-tokens"},{"cve":"CVE-2026-115931","cvss":9.9,"slug":"cve-2026-115931-postiz-lets-a-signed-in-user-ask-the-backend-to-run-a-function","title":"GitroomHQ Postiz arbitrary file read and denial of service","severity":"critical","exploited":false,"published_at":"2026-10-23T23:17:43.263+00:00","url":"https://junglewise.ai/threats/cve-2026-115931-postiz-lets-a-signed-in-user-ask-the-backend-to-run-a-function"},{"cve":"CVE-2026-115932","cvss":9.6,"slug":"cve-2026-115932-when-a-post-is-published-postiz-treats-a-media-path-that-is-not","title":"Postiz path traversal in post media processing","severity":"critical","exploited":false,"published_at":"2026-10-24T13:16:37.217+00:00","url":"https://junglewise.ai/threats/cve-2026-115932-when-a-post-is-published-postiz-treats-a-media-path-that-is-not"},{"cve":"CVE-2026-94456","cvss":9.1,"epss":0.0052,"slug":"cve-2026-94456-postiz-generates-security-sensitive-credentials-using-math-random","title":"GitroomHQ Postiz insecure random source in credential generation","severity":"critical","exploited":false,"published_at":"2026-09-22T17:17:31.67+00:00","url":"https://junglewise.ai/threats/cve-2026-94456-postiz-generates-security-sensitive-credentials-using-math-random"},{"cve":"CVE-2026-107761","epss":0.0028,"slug":"cve-2026-107761-several-postiz-endpoints-return-the-complete-database-row-of-the","title":"Postiz information disclosure in API responses","severity":"info","exploited":false,"published_at":"2026-10-11T16:16:30.49+00:00","url":"https://junglewise.ai/threats/cve-2026-107761-several-postiz-endpoints-return-the-complete-database-row-of-the"}],"generated_at":"2026-11-11T03:07:00.183524+00:00"}