https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 22:55:36 +0000 https://cve.radiocsirt.org/vuln/cve-2026-105696 <p><strong>Affected:</strong> penpot</p> <p>Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-page RPC accepts a share-link permission object with blanket read access but does not verify that the caller-selected page-id belongs to the link&#39;s authorized pages set. An attacker with both a valid share link and the attacker&#39;s own authenticated Penpot session can retrieve the complete shape and design data of another page in the same file when its identifier is known, because get-page requires authentication. The related get-file-fragment RPC also permits share-link access without mapping fragments to authorized pages. This issue is fixed in version 2.18.0.</p> <p><strong>Affected:</strong> penpot</p> <p>Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-page RPC accepts a share-link permission object with blanket read access but does not verify that the caller-selected page-id belongs to the link&#39;s authorized pages set. An attacker with both a valid share link and the attacker&#39;s own authenticated Penpot session can retrieve the complete shape and design data of another page in the same file when its identifier is known, because get-page requires authentication. The related get-file-fragment RPC also permits share-link access without mapping fragments to authorized pages. This issue is fixed in version 2.18.0.</p> https://cve.radiocsirt.org/vuln/cve-2026-105696