CVE-2026-105696

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-page RPC accepts a share-link permission object with blanket read access but does not verify that the caller-selected page-id belongs to the link's authorized pages set. An attacker with both a valid share link and...

CVE-2026-105696

The Penpot design and prototyping platform is vulnerable to a page-scope escalation in versions prior to 2.18.0 . The get-page and get-file-fragment RPC commands fail to verify if a requested page-id or fragment belongs to the authorized set of a provided share-link permission object. An authenti...

CVE-2026-105696 Penpot: Share-link page-scope escalation: a share-link holder reads pages outside the link's authorized scope via the get-page RPC command

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-page RPC accepts a share-link permission object with blanket read access but does not verify that the caller-selected page-id belongs to the link's authorized pages set. An attacker with both a valid share link and...

CVE-2026-105696 Penpot: Share-link page-scope escalation: a share-link holder reads pages outside the link's authorized scope via the get-page RPC command

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-page RPC accepts a share-link permission object with blanket read access but does not verify that the caller-selected page-id belongs to the link's authorized pages set. An attacker with both a valid share link and...

charmcraft (>=1.4.0, <=2.2.0), optikka-design-data-layer (0.1.58) +4 more potentially affected by CVE-2026-69248 via cryptography (3.4.0)

cryptography PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - charmcraft =1.4.0, =4.2.3, =0.1.0, =1.7.0, =0.0.1, =0.0.4 Source cves: CVE-2026-69248 Source advisory: OSV:PYSEC-2026-3554...

charmcraft (>=1.4.0, <=2.2.0), optikka-design-data-layer (0.1.58) +4 more potentially affected by CVE-2026-69249 via cryptography (3.4.0)

cryptography PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - charmcraft =1.4.0, =4.2.3, =0.1.0, =1.7.0, =0.0.1, =0.0.4 Source cves: CVE-2026-69249 Source advisory: OSV:PYSEC-2026-3553...

CVE-2026-16068

The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting it, allowing authenticated users with Author-level access and above to store arbitrary JavaScript that is then served unsanitise...

CVE-2026-16068

The Brizy - Page Builder WordPress plugin (versions prior to 2.8.19 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the improper restriction on who can modify site-global design data and a failure to sanitize specific data before it is output. This allows authenticated us...

CVE-2026-16068 Brizy - Page Builder < 2.8.19 - Author+ Stored XSS via brizy_set_project Global Project Code Asset

The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting it, allowing authenticated users with Author-level access and above to store arbitrary JavaScript that is then served unsanitise...

CVE-2026-16068

The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting it, allowing authenticated users with Author-level access and above to store arbitrary JavaScript that is then served unsanitise...

CVE-2026-16068 Brizy - Page Builder < 2.8.19 - Author+ Stored XSS via brizy_set_project Global Project Code Asset

The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting it, allowing authenticated users with Author-level access and above to store arbitrary JavaScript that is then served unsanitise...

EUVD-2026-52593

The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting it, allowing authenticated users with Author-level access and above to store arbitrary JavaScript that is then served unsanitise...

PT-2026-67656

The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting it, allowing authenticated users with Author-level access and above to store arbitrary JavaScript that is then served unsanitise...

CVE-2026-16068: Improper Neutralization of Input During Web Page Generation

The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting it, allowing authenticated users with Author-level access and above to store arbitrary JavaScript that is then served unsanitise...

CVE-2026-9725

The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 2.5.2 This is due to insufficient path validation in the storedesigndata function, which constructs a filesystem path from the user-supplied...

CVE-2026-9725

The CVE-2026-9725 issue affects the Printcart Web to Print Product Designer for WooCommerce plugin for WordPress (versions

charmcraft (>=1.4.0, <=2.2.0), optikka-design-data-layer (0.1.58) +4 more potentially affected by CVE-2026-34073 via cryptography (3.4.0)

cryptography PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - charmcraft =1.4.0, =4.2.3, =0.1.0, =1.7.0, =0.0.1, =0.0.4 Source cves: CVE-2026-34073 Source advisory: OSV:PYSEC-2026-35...

charmcraft (>=1.4.0, <=2.2.0), optikka-design-data-layer (0.1.58) +4 more potentially affected by CVE-2026-26007 via cryptography (3.4.0)

cryptography PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - charmcraft =1.4.0, =4.2.3, =0.1.0, =1.7.0, =0.0.1, =0.0.4 Source cves: CVE-2026-26007 Source advisory: OSV:PYSEC-2026-2141...

charmcraft (>=1.4.0, <=2.2.0), optikka-design-data-layer (0.1.58) +4 more potentially affected by CVE-2026-26007 via cryptography (3.4.0)

cryptography PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - charmcraft =1.4.0, =4.2.3, =0.1.0, =1.7.0, =0.0.1, =0.0.4 Source cves: CVE-2026-26007 Source advisory: OSV:GHSA-R6PH-V2QM-Q3C2...

CVE-2025-27377

Altium Designer version 24.9.0 does not validate self-signed server certificates for cloud connections. An attacker capable of performing a man-in-the-middle MITM attack could exploit this issue to intercept or manipulate network traffic, potentially exposing authentication credentials or sensiti...