diff --git a/CHANGES.md b/CHANGES.md
index 0874c7783d..824a7a8da4 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,10 +1,17 @@
 # CHANGELOG
 
+## 2.13.3
+
+### :bug: Bugs fixed
+
+- Revert yetti (http server) update, because that caused a regression on multipart uploads
+
+
 ## 2.13.2
 
 ### :bug: Bugs fixed
 
-- Revert yetti (http server) update, because that caused a regression on multipart uploads
+- Fix arbitrary file read security issue on create-font-variant rpc method (https://github.com/penpot/penpot/security/advisories/GHSA-xp3f-g8rq-9px2)
 
 
 ## 2.13.1