CVE-2026-44986

Penpot is an open-source design tool for design and code collaboration. Prior to 2.14.5, Penpot exposed teams_invitations.clj invitation tokens from create-team-invitations, embedded an existing profile id in auth.clj prepare-register-profile, and had auth.clj register-profile issue a session based on the invitation email match without password verification, allowing a registered user to take over any non-blocked profile. This issue is fixed in version 2.14.5.

• CWE-287
• CWE-639

• https://github.com/penpot/penpot/commit/9e681260ccc4feb6c564ff0773fb9594b462c574
• https://github.com/penpot/penpot/pull/9380
• https://github.com/penpot/penpot/releases/tag/2.14.5
• https://github.com/penpot/penpot/security/advisories/GHSA-4937-35vc-hqjj
• https://github.com/penpot/penpot/security/advisories/GHSA-4937-35vc-hqjj

Published

Jul 15, 2026

Last Modified

Jul 15, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44979@hapi/wreck is an HTTP client utility. Prior to 18.1.1, when…6.3
• CVE-2026-4498Execution with Unnecessary Privileges (CWE-250) in Kibana’s …7.7
• CVE-2026-44981CrowdSec offers crowdsourced protection against malicious IP…8.2
• CVE-2026-44982CrowdSec offers crowdsourced protection against malicious IP…7.2
• CVE-2026-44983smallbitvec is a growable bit-vector for Rust, optimized for…7.3
• CVE-2026-44985Dozzle is a realtime log viewer for docker containers. Prior…9.6
• CVE-2026-44987SysReptor is a fully customizable pentest reporting platform…3.8
• CVE-2026-44988LibVNCClient is a library for easy implementation of a VNC c…8.8
• CVE-2026-4499A vulnerability was determined in D-Link DIR-820LW 2.03. Aff…9.8
• CVE-2026-44990ApostropheCMS is an open-source Node.js content management s…9.3
• CVE-2026-44991OpenClaw before 2026.4.21 contains an authorization bypass v…4.2
• CVE-2026-44992OpenClaw versions 2026.4.5 before 2026.4.20 contain an envir…5