posta vulnerabilities

CVEs whose affected-version data names the posta package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-123204Medium· 4.3

yesterday

Posta before v0.18.0 SSRF via Webhook URL

Posta before v0.18.0 contains a server-side request forgery vulnerability that allows authenticated users with edit rights to make the backend send POST requests to internal destinations by creating webhooks with arbitrary URLs. Attacker…

▾ Sunlitgoposta · postavia CVEORG