agentprime: penpotEvery new CVE for penpot.https://agentprime.io/CVE-2026-105696: Penpot: Share-link page-scope escalation: a share-link holder reads pages outside the link's authorized scope via the get-page RPC commandhttps://agentprime.io/advisories/CVE-2026-105696/https://agentprime.io/advisories/CVE-2026-105696/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 20:05:30 GMTCVECVE-2026-105695: Penpot: Missing authorization in chunked-upload assembly lets another authenticated user consume a victim's upload sessionhttps://agentprime.io/advisories/CVE-2026-105695/https://agentprime.io/advisories/CVE-2026-105695/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 20:04:22 GMTCVECVE-2026-105694: Penpot: Stored XSS via Unsanitised SVG Uploadshttps://agentprime.io/advisories/CVE-2026-105694/https://agentprime.io/advisories/CVE-2026-105694/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 20:02:03 GMTCVECVE-2026-105693: Penpot: Anonymous share-link token disclosure & page-scope bypass via get-view-only-bundlehttps://agentprime.io/advisories/CVE-2026-105693/https://agentprime.io/advisories/CVE-2026-105693/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 19:56:47 GMTCVECVE-2026-105692: Penpot: IDOR in Share-Link Deletion Allows Any File Editor to Delete Share-Links They Did Not Createhttps://agentprime.io/advisories/CVE-2026-105692/https://agentprime.io/advisories/CVE-2026-105692/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 19:55:36 GMTCVECVE-2026-105691: Penpot: Authenticated OS Command Injection in Penpot SVG Exporter via Legacy fill-colorhttps://agentprime.io/advisories/CVE-2026-105691/https://agentprime.io/advisories/CVE-2026-105691/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 19:53:54 GMTCVEcriticalCVE-2026-105690: Penpot: Server-side session not invalidated on logout; stale auth-token cookie remains valid for full profile accesshttps://agentprime.io/advisories/CVE-2026-105690/https://agentprime.io/advisories/CVE-2026-105690/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 19:52:08 GMTCVECVE-2026-105689: Penpot: SSRF guard bypass via IPv6 transition addresses (NAT64/6to4/Teredo) in webhook delivery and media downloadhttps://agentprime.io/advisories/CVE-2026-105689/https://agentprime.io/advisories/CVE-2026-105689/CVSS 6.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 19:51:04 GMTCVECVE-2026-105688: Penpot: Team admin can escalate to owner via team invitation (missing owner-role guard on the invitation path)https://agentprime.io/advisories/CVE-2026-105688/https://agentprime.io/advisories/CVE-2026-105688/CVSS 6.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 19:50:01 GMTCVECVE-2026-105687: Penpot: A team admin (non-owner) can remove the team owner via ::delete-team-member — missing owner-protectionhttps://agentprime.io/advisories/CVE-2026-105687/https://agentprime.io/advisories/CVE-2026-105687/CVSS 4.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 19:49:04 GMTCVECVE-2026-105686: Penpot: Repeated chunk index causes temporary-storage amplificationhttps://agentprime.io/advisories/CVE-2026-105686/https://agentprime.io/advisories/CVE-2026-105686/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 19:47:56 GMTCVECVE-2026-105684: Penpot: Share-link page-scope escape — comment RPCs leak comment content, author identity, and all page-ids for pages outside the share scopehttps://agentprime.io/advisories/CVE-2026-105684/https://agentprime.io/advisories/CVE-2026-105684/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 19:44:07 GMTCVECVE-2026-100868: Penpot before 2.18.0 Unauthenticated WebSocket Access via MCP Bridgehttps://agentprime.io/advisories/CVE-2026-100868/https://agentprime.io/advisories/CVE-2026-100868/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 27 Sep 2026 13:09:53 GMTCVECVE-2026-47665: Penpot: Stored XSS via comment content, innerHTML renders unsanitized HTMLhttps://agentprime.io/advisories/CVE-2026-47665/https://agentprime.io/advisories/CVE-2026-47665/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 26 Aug 2026 22:50:34 GMTCVECVE-2026-47666: Penpot: Stored XSS via custom font family name injected into a @font-face style rulehttps://agentprime.io/advisories/CVE-2026-47666/https://agentprime.io/advisories/CVE-2026-47666/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 26 Aug 2026 22:47:49 GMTCVECVE-2026-17613: CVE-2026-17613https://agentprime.io/advisories/CVE-2026-17613/https://agentprime.io/advisories/CVE-2026-17613/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 05 Aug 2026 14:12:03 GMTCVECVE-2026-44986: Penpot: Pre-authenticated account takeover via team-invitation token + prepare-register-profilehttps://agentprime.io/advisories/CVE-2026-44986/https://agentprime.io/advisories/CVE-2026-44986/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 15 Jul 2026 15:08:37 GMTCVEcriticalCVE-2026-45806: Penpot: Authenticated SSRF in remote image import via create-file-media-object-from-urlhttps://agentprime.io/advisories/CVE-2026-45806/https://agentprime.io/advisories/CVE-2026-45806/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 15 Jul 2026 15:05:35 GMTCVECVE-2026-26202: Penpot has Arbitrary File Read via create-font-variant RPC endpointhttps://agentprime.io/advisories/CVE-2026-26202/https://agentprime.io/advisories/CVE-2026-26202/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 19 Feb 2026 19:23:49 GMTCVE