[ Vendor · 13 CVEs ]
penpot
CVEs affecting penpot published in the last 30 days, plus any penpot CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-105695 | 5 Oct 2026 | CVSS 5.9 | penpotPenpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its session ID… | |
| CVE-2026-105696 | 5 Oct 2026 | CVSS 6.5 | penpotPenpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-page RPC accepts a share-link permission object with blanket read… | |
| CVE-2026-105691 | 5 Oct 2026 | CVSS 9.9 | penpotPenpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attacker-controlled text object's fill-color… | |
| CVE-2026-105692 | 5 Oct 2026 | CVSS 5.4 | penpotPenpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-share-link RPC retrieves a caller-selected share-link ID and… | |
| CVE-2026-105693 | 5 Oct 2026 | CVSS 5.3 | penpotPenpot is an open-source design and prototyping platform. Prior to 2.18.0, the unauthenticated get-view-only-bundle RPC returns every share-link row… | |
| CVE-2026-105694 | 5 Oct 2026 | CVSS 5.4 | penpotPenpot is an open-source design and prototyping platform. Prior to 2.18.0, authenticated users with file-edit permission can upload SVG media whose… | |
| CVE-2026-105688 | 5 Oct 2026 | CVSS 6.7 | penpotPenpot is an open-source design and prototyping platform. Prior to 2.18.0, create-team-invitations and the invitation acceptance path allow a… | |
| CVE-2026-105689 | 5 Oct 2026 | CVSS 6.0 | penpotPenpot is an open-source design and prototyping platform. Prior to 2.18.0, app.util.ssrf/blocked-address? relies on Java InetAddress predicates that… | |
| CVE-2026-105690 | 5 Oct 2026 | CVSS 5.9 | penpotPenpot is an open-source design and prototyping platform. Prior to 2.18.0, logout clears the browser's auth-token cookie without revoking the… | |
| CVE-2026-105684 | 5 Oct 2026 | CVSS 4.3 | penpotPenpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-comment-threads, get-comment-thread, and get-comments RPC commands… | |
| CVE-2026-105686 | 5 Oct 2026 | CVSS 5.3 | penpotPenpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but… | |
| CVE-2026-105687 | 5 Oct 2026 | CVSS 4.9 | penpotPenpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-team-member RPC allows a team administrator to remove any… | |
| CVE-2026-100868 | 27 Sep 2026 | CVSS 6.3 | penpotPenpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode… |