Filtered by vendor Penpot Subscriptions
Filtered by product Mcp Subscriptions
Total 1 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-100868 2 Kaleidos, Penpot 3 Penpot, Mcp, Penpot 2026-09-28 6.3 Medium
Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, intercept task payloads, and return forged results to the MCP client.