Canva Canva
5 CVEs affecting Canva Canva. Latest disclosed: 2026-09-21. Critical: 1, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-85085 | Critical | 9.6 | 2026-09-04 | The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user i… |
CVE-2026-85094 | High | 8.8 | 2026-09-04 | The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control… |
CVE-2026-90860 | High | 7.1 | 2026-09-21 | The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor w… |
CVE-2026-92839 | Medium | 4.3 | 2026-09-17 | Canva Desktop before v1.125.0 performed double decoding in the deeplink handler. A threat actor could cause the application to load arbitrary same-origin conte… |
CVE-2025-12792 | Low | 3.2 | 2025-11-18 | The Mac App Store distribution of the Canva for Mac desktop app before 1.117.1 was built without Hardened Runtime. A local threat actor with unprivileged acces… |