JG
Vendor
jgraph
11
CVEs
0
On KEV
1
New 30D
Products
DR5.6
drawio-desktop
jgraph
1 CVEs0 on KEV1 new
DR7.7
drawio
jgraph
7 CVEs0 on KEV0 new
MX9.8
Mxgraph
Jgraph
3 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-114606 New | DR drawio-desktop jgraph | 5.6 | Oct 22 | draw.io Desktop: Arbitrary local-file read via read-side IPC (no blessed-path gate) |
| CVE-2026-76898 | DR drawio jgraph | 7.7 | Sep 21 | draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js |
| CVE-2026-63373 | DR drawio jgraph | 4.2 | Sep 21 | draw.io: OAuth CSRF via missing state validation on self-hosted deployments allows session token injection |
| CVE-2026-63334 | DR drawio jgraph | 6.8 | Sep 21 | draw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklist |
| CVE-2026-63416 | DR drawio jgraph | 3.7 | Sep 21 | draw.io: Path traversal in ExportProxyServlet allows access to arbitrary backend endpoints |
| CVE-2026-58504 | DR drawio jgraph | 6.1 | Sep 21 | draw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642 |
| CVE-2026-46642 | DR drawio jgraph | 6.1 | Jun 10 | draw.io: XSS via crafted cell label when opening a .drawio file |
| CVE-2026-42195 | DR drawio jgraph | 3.4 | May 8 | Unvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled host |
| CVE-2022-40440 | MX Mxgraph Jgraph | 6.1 | Oct 11 | mxGraph v4.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the setTooltips() function |
| CVE-2019-13127 | MX Mxgraph Jgraph | 6.1 | Jul 1 | An issue was discovered in mxGraph through 4.0.0, related to the "draw.io Diagrams" plugin before 8.3.14 for Confluence and other products |
| CVE-2017-18197 | MX Mxgraph Jgraph | 9.8 | Feb 24 | In mxGraphViewImageReader.java in mxGraph before 3.7.6, the SAXParserFactory instance in convert() is missing flags to prevent XML External Entity (XXE) attacks, as demonstrated… |