Penpot @penpot/mcp vulnerabilities

• penpot, penpot @penpot/mcp +1 more Penpot before 2.18.0 Unauthenticated WebSocket Access via MCP Bridge CVE-2026-100868 5.3 MediumSeptember 27, 2026