🔓 CVEs & KEV
CVE-2026-105691 — penpot — CVSS 9.9 — Penpot: Authenticated OS Command Injection in Penpot SVG Exporter via Legacy ...
CVE-2026-105639 — makeplane plane — CVSS 9.8 — Plane Project Management Tool Critical Flaw Enables Unauthenticated Workspace Takeover
CVE-2026-105638 — makeplane plane — CVSS 9.1 — Plane Project Management Tool Critical OTP Brute-Force Leads to Unauthenticated Account Takeover
CVE-2026-105688 — penpot — CVSS 6.7 — Penpot: Team admin can escalate to owner via team invitation (missing owner-r...
CVE-2026-105696 — penpot — CVSS 6.5 — Penpot: Share-link page-scope escalation: a share-link holder reads pages out...
CVE-2026-105689 — penpot — CVSS 6.0 — Penpot: SSRF guard bypass via IPv6 transition addresses (NAT64/6to4/Teredo) i...
📋 ADVISORIES
- 📄 Source for CVE-2026-97283: Critical PHP object injection flaw in Liquid Web / StellarWP Advanced Post Manager plugin — patchstack.com