Login Request a demo
PE
Product
penpot
by penpot · last CVE Oct 5, 2026
20
CVEs
0
On KEV
9.9
Max CVSS
12
New 30D
Vulnerabilities20In the news0Timeline
Severity mix
Critical 2High 6Medium 12Low 0
Severity
All severities20Critical2High6Medium12Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add penpot to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-45805
8.8
0%
Jul 15
Penpot: MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE
Affected: < 2.15.0
CVE-2026-47665
8.7
0%
Aug 26
Penpot: Stored XSS via comment content, innerHTML renders unsanitized HTML
Affected: < 2.15.3
CVE-2026-45806
7.7
0%
Jul 15
Penpot: Authenticated SSRF in remote image import via create-file-media-object-from-url
Affected: < 2.15.0
CVE-2026-47666
7.6
0%
Aug 26
Penpot: Stored XSS via custom font family name injected into a @font-face style rule
Affected: < 2.15.3
CVE-2026-17613
7.5
1%
Aug 5
No description published yet
Affected: 1.20 through 2.17.1
CVE-2026-26202
7.5
0%
Feb 19
Penpot has Arbitrary File Read via create-font-variant RPC endpoint
Affected: < 2.13.2
Showing 6