CVE-2026-47665Proof of concept (PoC) published · CISA
Penpot: Stored XSS via comment content, innerHTML renders unsanitized HTML
CVSS score
8.7
EPSS probability
%0.4
Risk score
0.0
Published
1 mo ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
No verified public exploit code was found.
GitHub repositories, NVD exploit references and the Metasploit Framework were scanned. A record of active exploitation does not mean that public exploit code has been published.
Similar Vulnerabilities
7.5
CVE-2026-17613
CVE-2026-17613
P
Patch status unknownEPSS %1
9.9
CVE-2026-105691
Penpot: Authenticated OS Command Injection in Penpot SVG Exporter via Legacy fill-color
P
Patch status unknownEPSS %0
7.6
CVE-2026-47666
Penpot: Stored XSS via custom font family name injected into a @font-face style rule
P
Patch status unknownEPSS %0
6.5
CVE-2026-105696
Penpot: Share-link page-scope escalation: a share-link holder reads pages outside the link's authorized scope via the get-page RPC command
P
Patch status unknownEPSS %0
6.7
CVE-2026-105688
Penpot: Team admin can escalate to owner via team invitation (missing owner-role guard on the invitation path)
P
Patch status unknownEPSS %0
5.9
CVE-2026-105695
Penpot: Missing authorization in chunked-upload assembly lets another authenticated user consume a victim's upload session
P
Patch status unknownEPSS %0
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-47665"