P
Vendor security profile
Penpot
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs16
Critical1
CISA KEV0
Public exploit11
Patch rate%6
Avg. CVSS6.3
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
3
1
12
CVE KEV
CVE severity distribution
16toplam CVE
Critical1 (6%)
High3 (19%)
Medium12 (75%)
Patch and exploitation view
%6
Verified patch
%0
CISA KEV
%69
Public exploit
1Patch available
0Partial
0Workaround
0Vendor: no patch
15Unknown
Latest vulnerabilities
6.5
CVE-2026-105696
Penpot: Share-link page-scope escalation: a share-link holder reads pages outside the link's authorized scope via the get-page RPC command
P
Patch status unknownEPSS %0
5.9
CVE-2026-105695
Penpot: Missing authorization in chunked-upload assembly lets another authenticated user consume a victim's upload session
P
Patch status unknownEPSS %0
5.4
CVE-2026-105694
Penpot: Stored XSS via Unsanitised SVG Uploads
P
Patch status unknownEPSS %0
5.3
CVE-2026-105693
Penpot: Anonymous share-link token disclosure & page-scope bypass via get-view-only-bundle
P
Patch status unknownEPSS %0
5.4
CVE-2026-105692
Penpot: IDOR in Share-Link Deletion Allows Any File Editor to Delete Share-Links They Did Not Create
P
Patch status unknownEPSS %0
9.9
CVE-2026-105691
Penpot: Authenticated OS Command Injection in Penpot SVG Exporter via Legacy fill-color
P
Patch status unknownEPSS %0
5.9
CVE-2026-105690
Penpot: Server-side session not invalidated on logout; stale auth-token cookie remains valid for full profile access
P
Patch status unknownEPSS %0
6.0
CVE-2026-105689
Penpot: SSRF guard bypass via IPv6 transition addresses (NAT64/6to4/Teredo) in webhook delivery and media download
P
Patch status unknownEPSS %0
6.7
CVE-2026-105688
Penpot: Team admin can escalate to owner via team invitation (missing owner-role guard on the invitation path)
P
Patch status unknownEPSS %0
4.9
CVE-2026-105687
Penpot: A team admin (non-owner) can remove the team owner via ::delete-team-member — missing owner-protection
P
Patch status unknownEPSS %0