Login Request a demo
DR
Product
drawio
by jgraph · last CVE Sep 21, 2026
7
CVEs
0
On KEV
7.7
Max CVSS
0
New 30D
Vulnerabilities7In the news0Timeline
Severity mix
Critical 0High 1Medium 4Low 2
Severity
All severities7Critical0High1Medium4Low2
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add drawio to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-76898
7.7
0%
Sep 21
draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js
Affected: < 30.3.8
CVE-2026-63334
6.8
0%
Sep 21
draw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklist
Affected: < 30.2.7
CVE-2026-58504
6.1
0%
Sep 21
draw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642
Affected: < 30.2.5
CVE-2026-46642
6.1
0%
Jun 10
draw.io: XSS via crafted cell label when opening a .drawio file
Affected: < 29.7.12
CVE-2026-63373
4.2
0%
Sep 21
draw.io: OAuth CSRF via missing state validation on self-hosted deployments allows session token injection
Affected: < 30.2.7
CVE-2026-63416
3.7
0%
Sep 21
draw.io: Path traversal in ExportProxyServlet allows access to arbitrary backend endpoints
Affected: < 30.2.7
CVE-2026-42195
3.4
0%
May 8
Unvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled host
Affected: < 29.7.9
Showing 7