Jgraph Drawio
7 CVEs affecting Jgraph Drawio. Latest disclosed: 2026-09-21. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-63334 | Medium | 6.8 | 2026-09-21 | draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, deployments with ENABLE_DRAWIO_PROXY=1 are vulnerable to server-s… |
CVE-2026-58504 | Medium | 6.1 | 2026-09-21 | draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.5, opening or importing a crafted .drawio file can execute attacker-… |
CVE-2026-46642 | Medium | 6.1 | 2026-06-10 | draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.12, a crafted .drawio file can execute arbitrary JavaScript in the e… |
CVE-2026-63373 | Medium | 4.2 | 2026-09-21 | draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, the OAuth callback handler in src/main/java/com/mxgraph/online/Ab… |
CVE-2026-63416 | Low | 3.7 | 2026-09-21 | draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, src/main/java/com/mxgraph/online/ExportProxyServlet.java uses req… |
CVE-2026-42195 | Low | 3.4 | 2026-05-08 | draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that override… |
CVE-2026-76898 | | 2026-09-21 | draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.3.8, src/main/java/com/mxgraph/online/Utils.java checks IPv6 Unique Lo… |