https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-16T22:40:10.801802+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-45806 CVE-2026-45806 — Penpot: Authenticated SSRF in remote image import via create-file-media-object-from-url 2026-10-16T22:40:10.818298+00:00

Affected: penpot

Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot's remote image import passed the user-controlled url from frontend/src/app/main/data/workspace/media.cljs into the backend RPC method :create-file-media-object-from-url in backend/src/app/rpc/commands/media.clj, where media/download-image in backend/src/app/media.clj used the shared HTTP client without destination filtering, allowing an authenticated file editor to reach internal-only endpoints. This issue is fixed in version 2.15.0.