DR
Product
drawio
7
CVEs
0
On KEV
7.7
Max CVSS
0
New 30D
Severity mix
Critical 0High 1Medium 4Low 2
Watch
Add drawio to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-63334 | 6.8 | Sep 21 | draw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklist Affected: < 30.2.7 |
| CVE-2026-58504 | 6.1 | Sep 21 | draw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642 Affected: < 30.2.5 |
| CVE-2026-46642 | 6.1 | Jun 10 | draw.io: XSS via crafted cell label when opening a .drawio file Affected: < 29.7.12 |
| CVE-2026-63373 | 4.2 | Sep 21 | draw.io: OAuth CSRF via missing state validation on self-hosted deployments allows session token injection Affected: < 30.2.7 |
Showing 4