Product by Penpot

    Penpot

    20 known vulnerabilities in Penpot (Penpot), 0 of them actively exploited (CISA KEV).

    Key figures

    20

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    2

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Penpot (Penpot)
    CriticalCVE-2026-105691

    Penpot: Authenticated OS Command Injection in Penpot SVG Exporter via Legacy fill-color

    		9.9
    CriticalCVE-2026-44986

    Penpot: Pre-authenticated account takeover via team-invitation token + prepare-register-profile

    		9.9
    HighCVE-2026-47665

    Penpot: Stored XSS via comment content, innerHTML renders unsanitized HTML

    		8.7
    HighCVE-2026-17613

    Penpot: security vulnerability

    		7.5
    MediumCVE-2026-100868

    Penpot before 2.18.0 Unauthenticated WebSocket Access via MCP Bridge

    		6.3
    HighCVE-2026-45805

    Penpot: MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE

    		8.8
    MediumCVE-2026-105688

    Penpot: Improper Privilege Management

    		6.7
    HighCVE-2026-47666

    Penpot: Stored XSS via custom font family name injected into a @font-face style rule

    		7.6
    HighCVE-2026-26202

    Penpot has Arbitrary File Read via create-font-variant RPC endpoint

    		7.5
    MediumCVE-2026-105696

    Penpot: Missing Authorization

    		6.5
    HighCVE-2026-45806

    Penpot: Authenticated SSRF in remote image import via create-file-media-object-from-url

    		7.7
    MediumCVE-2026-105689

    Penpot: Server-Side Request Forgery (SSRF)

    		—
    MediumCVE-2026-105695

    Penpot: Missing Authorization

    		5.9
    MediumCVE-2026-105686

    Penpot: Repeated chunk index causes temporary-storage amplification

    		—
    MediumCVE-2026-105690

    Penpot: Insufficient Session Expiration

    		5.9
    MediumCVE-2026-105693

    Penpot: Anonymous share-link token disclosure & page-scope bypass via get-view-only-bundle

    		5.3
    MediumCVE-2026-105687

    Penpot: Improper Privilege Management

    		4.9
    MediumCVE-2026-105692

    Penpot: IDOR in Share-Link Deletion Allows Any File Editor to Delete Share-Links They Did Not Create

    		5.4
    MediumCVE-2026-105694

    Penpot: Stored XSS via Unsanitised SVG Uploads

    		5.4
    MediumCVE-2026-105684

    Penpot: Exposure of Sensitive Information to an Unauthorized Actor

    		4.3

    All products by Penpot