Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
35 results
Oct 22, 2026draw.io Desktop is the official Electron build of draw.io.CVE-2026-114606 · Other software · jgraph · reported by GitHubMedium 5.6
draw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary local-file disclosure through the Electron main process's read-side IPC handlers. The readFile, getFileDrafts, getBkpFile, fileStat, isFileWritable, checkFileExists, and watchFile actions operate on a renderer-chosen filesystem path with no blessed-path (assertWritablePath) authorization. The only gates are validateSender — a URL-prefix origin check — plus, for readFile alone, a content "sniff" and a lexical appBaseDir prefix block. The write-side handlers (saveFile, writeFile, saveDraft, deleteFile) are all protected by assertWritablePath; the read side is not. The result is a read/write authorization asymmetry: any frame executing in the app's file:// origin can read the contents of local files that the same origin is explicitly forbidden to write. This issue is fixed in version 31.4.4.
- Product
- drawio-desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026draw.io is a configurable diagramming and whiteboarding application.CVE-2026-76898 · Other software · jgraph · reported by GitHubHigh 7.7
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.3.8, src/main/java/com/mxgraph/online/Utils.java checks IPv6 Unique Local Addresses in Utils.sanitizeUrl() by comparing the text prefixes fc00:: and fd00::, but the JDK returns the expanded address form, so the fc00::/7 range, including the AWS metadata range fd00:ec2::/32, is not blocked. An unauthenticated request to /embed2.js?fetch= can therefore make src/main/java/com/mxgraph/online/EmbedServlet2.java fetch an IPv6 ULA internal resource and reflect the response to the requester. Utils.validatedAddress() uses the same private-address check for the separate ProxyServlet path, which requires ENABLE_DRAWIO_PROXY=1. The primary /embed2.js path requires no proxy feature flag or DNS rebinding, and it can disclose cloud metadata credentials or data from other IPv6-reachable internal services. This issue is fixed in version 30.3.8.
- Product
- drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026draw.io is a configurable diagramming and whiteboarding application.CVE-2026-63416 · Other software · jgraph · reported by GitHubLow 3.7
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, src/main/java/com/mxgraph/online/ExportProxyServlet.java uses request.getPathInfo() to build a proxyPath and appends it directly to EXPORT_URL without rejecting dot segments or confirming that the normalized destination remains under the configured export path. An unauthenticated request containing traversal segments can therefore address unintended routes on the internal export server, and the servlet forwards all request headers and the request body to that destination, allowing arbitrary header injection. Depending on the export service configuration, exploitation can expose administration, debugging, health, or configuration endpoints and can permit unintended internal actions. This issue is fixed in version 30.2.7.
- Product
- drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026draw.io is a configurable diagramming and whiteboarding application.CVE-2026-63373 · Other software · jgraph · reported by GitHubMedium 4.2
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, the OAuth callback handler in src/main/java/com/mxgraph/online/AbsAuth.java skips comparison of stateToken and cookieToken whenever IS_GAE is false, which affects self-hosted Docker and WAR deployments. An attacker can provide an authorization code for the attacker's cloud-storage identity and induce a victim to visit a callback URL, causing the victim's draw.io session to become authenticated as the attacker identity without a valid state binding. The shared handler affects Google Drive, OneDrive, GitHub, GitLab, and Dropbox integrations. The victim can then unknowingly perform cloud-storage actions under the attacker's identity, causing session integrity loss and misattribution, but the identity binding does not itself grant access to existing victim cloud files. This issue is fixed in version 30.2.7.
- Product
- drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026draw.io is a configurable diagramming and whiteboarding application.CVE-2026-63334 · Other software · jgraph · reported by GitHubMedium 6.8
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, deployments with ENABLE_DRAWIO_PROXY=1 are vulnerable to server-side request forgery because src/main/java/com/mxgraph/online/Utils.java performs the private-address check in Utils.sanitizeUrl() using one DNS resolution, while src/main/java/com/mxgraph/online/ProxyServlet.java later calls URL.openConnection() and performs a second resolution. An attacker-controlled hostname can resolve to a public address during validation and then to a private, link-local, or cloud metadata address when the connection is opened. Successful exploitation can return cloud instance metadata or responses from internal HTTP services through the proxy. This issue is fixed in version 30.2.7.
- Product
- drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026draw.io is a configurable diagramming and whiteboarding application.CVE-2026-58504 · Other software · jgraph · reported by GitHubMedium 6.1
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.5, opening or importing a crafted .drawio file can execute attacker-controlled JavaScript in the draw.io origin when selected cells are processed by TextFormatPanel.addFont() in src/main/webapp/js/grapheditor/Format.js. An HTML sibling cell keeps the formatted-label path enabled while an editable=0 plain-text sibling is excluded from the merged selection style but remains in the iteration set. graph.cellRenderer.getLabelValue() returns that plain-text label without HTML encoding, and mxUtils.canConvertHtmlToSvg() parses it as HTML, bypassing the earlier CVE-2026-46642 remediation. Successful exploitation can expose diagram data, browser storage, non-HttpOnly cookies, and same-origin actions available to the victim. This issue is fixed in version 30.2.5.
- Product
- drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2026DrawIO for ownCloud is an application for using DrawIO with the file storage, synchronization, and sharing application ownCloud Classic.CVE-2025-53831 · Other software · owncloud · reported by GitHubHigh 8.2
DrawIO for ownCloud is an application for using DrawIO with the file storage, synchronization, and sharing application ownCloud Classic. In DrawIO for ownCloud prior to version 1.0.2, which corresponds to ownCloud 10 prior to version 10.15.3, attackers with access to the DrawIO app can leverage improper neutralization of input during web page generation to achieve stored XSS. Upgrade ownCloud 10 to version 10.15.3 or later or upgrade DrawIO for ownCloud 10 to version 1.0.2 or later to receive a patch.
- Product
- DrawIO for ownCloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2026draw.io is a configurable diagramming and whiteboarding application.CVE-2026-46642 · Other software · jgraph · reported by GitHubMedium 6.1
draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.12, a crafted .drawio file can execute arbitrary JavaScript in the editor's origin when the file is opened. The vulnerability is not in the label sanitizer (which works correctly on the rendering path) but in a feature-detection routine in the Text Format panel that reads the raw cell label and assigns it to a detached element's innerHTML without sanitization. Browsers fire onerror for failed image loads even on detached elements, so an <img src=x onerror=...> payload in any cell label triggers script execution as soon as the cell is selected — which import does automatically. This issue has been patched in version 29.7.12.
- Product
- drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026draw.io is a configurable diagramming and whiteboarding application.CVE-2026-42195 · Other software · jgraph · reported by GitHubLow 3.4
draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's "Authorize in GitLab" dialog to open a popup on the attacker-controlled host instead of gitlab.com. This can lead to credential fishing and session state token exfiltration. This issue has been patched in version 29.7.9.
- Product
- drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2023OS Command Injection in GitHub repository jgraph/drawio prior to 21.5.0.CVE-2023-3975 · Other software · jgraph · reported by security@huntr.devCritical 9.8
OS Command Injection in GitHub repository jgraph/drawio prior to 21.5.0.
- Product
- jgraph/drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2023OS Command Injection in GitHub repository jgraph/drawio prior to 21.4.0.CVE-2023-3974 · Other software · jgraph · reported by security@huntr.devCritical 9.8
OS Command Injection in GitHub repository jgraph/drawio prior to 21.4.0.
- Product
- jgraph/drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository jgraph/drawio prior to 21.6.3.CVE-2023-3973 · Other software · jgraph · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository jgraph/drawio prior to 21.6.3.
- Product
- jgraph/drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2023Denial of Service in GitHub repository jgraph/drawio prior to 18.1.3.CVE-2023-3398 · Other software · jgraph · reported by security@huntr.devHigh 7.5
Denial of Service in GitHub repository jgraph/drawio prior to 18.1.3.
- Product
- jgraph/drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2023Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 21.2.8.CVE-2023-3026 · Other software · jgraph · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 21.2.8.
- Product
- jgraph/drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2022Cross-site Scripting (XSS) - DOM in GitHub repository jgraph/drawio prior to 20.5.2.CVE-2022-3873 · Other software · jgraph · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - DOM in GitHub repository jgraph/drawio prior to 20.5.2.
- Product
- jgraph/drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2022Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 20.3.1.CVE-2022-3223 · Other software · jgraph · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 20.3.1.
- Product
- jgraph/drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2022OS Command Injection in GitHub repository jgraph/drawio prior to 20.3.0.CVE-2022-3133 · Other software · jgraph · reported by security@huntr.devHigh 7.8
OS Command Injection in GitHub repository jgraph/drawio prior to 20.3.0.
- Product
- jgraph/drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2022Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0.CVE-2022-3148 · Other software · jgraph · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0.
- Product
- jgraph/drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2022Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0.CVE-2022-3138 · Other software · jgraph · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0.
- Product
- jgraph/drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2022Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 20.2.8.CVE-2022-3127 · Other software · jgraph · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 20.2.8.
- Product
- jgraph/drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2022Improper Access Control in GitHub repository jgraph/drawio prior to 20.2.8.CVE-2022-3065 · Other software · jgraph · reported by security@huntr.devHigh 7.5
Improper Access Control in GitHub repository jgraph/drawio prior to 20.2.8.
- Product
- jgraph/drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 19.0.2.CVE-2022-2015 · Other software · jgraph · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 19.0.2.
- Product
- jgraph/drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022Code Injection in GitHub repository jgraph/drawio prior to 19.0.2.CVE-2022-2014 · Other software · jgraph · reported by security@huntr.devMedium 5.4
Code Injection in GitHub repository jgraph/drawio prior to 19.0.2.
- Product
- jgraph/drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2022Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.1.2.CVE-2022-1815 · Other software · jgraph · reported by security@huntr.devHigh 7.5
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.1.2.
- Product
- jgraph/drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.8.CVE-2022-1784 · Other software · jgraph · reported by security@huntr.devHigh 7.5
Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.8.
- Product
- jgraph/drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2022Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 18.0.4.CVE-2022-1730 · Other software · jgraph · reported by security@huntr.devMedium 4.6
Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 18.0.4.
- Product
- jgraph/drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2022Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.0.7.CVE-2022-1774 · Other software · jgraph · reported by security@huntr.devMedium 6.1
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.0.7.
- Product
- jgraph/drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2022Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.7.CVE-2022-1767 · Other software · jgraph · reported by security@huntr.devHigh 7.5
Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.7.
- Product
- jgraph/drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2022Improper Input Validation in GitHub repository jgraph/drawio prior to 18.0.6.CVE-2022-1727 · Other software · jgraph · reported by security@huntr.devHigh 8.8
Improper Input Validation in GitHub repository jgraph/drawio prior to 18.0.6.
- Product
- jgraph/drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2022Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.5.CVE-2022-1711 · Other software · jgraph · reported by security@huntr.devHigh 7.5
Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.5.
- Product
- jgraph/drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2022Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.6.CVE-2022-1723 · Other software · jgraph · reported by security@huntr.devHigh 7.5
Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.6.
- Product
- jgraph/drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2022SSRF in editor's proxy via IPv6 link-local address in GitHub repository jgraph/drawio prior to 18.0.5.CVE-2022-1722 · Other software · jgraph · reported by security@huntr.devLow 3.3
SSRF in editor's proxy via IPv6 link-local address in GitHub repository jgraph/drawio prior to 18.0.5. SSRF to internal link-local IPv6 addresses
- Product
- jgraph/drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2022Path Traversal in WellKnownServlet in GitHub repository jgraph/drawio prior to 18.0.5.CVE-2022-1721 · Other software · jgraph · reported by security@huntr.devHigh 7.5
Path Traversal in WellKnownServlet in GitHub repository jgraph/drawio prior to 18.0.5. Read local files of the web application.
- Product
- jgraph/drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2022SSRF on /proxy in GitHub repository jgraph/drawio prior to 18.0.4.CVE-2022-1713 · Other software · jgraph · reported by security@huntr.devHigh 7.5
SSRF on /proxy in GitHub repository jgraph/drawio prior to 18.0.4. An attacker can make a request as the server and read its contents. This can lead to a leak of sensitive information.
- Product
- jgraph/drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2022Arbitrary Code Execution through Sanitizer Bypass in GitHub repository jgraph/drawio prior to 18.0.0.CVE-2022-1575 · Other software · jgraph · reported by security@huntr.devCritical 9.6
Arbitrary Code Execution through Sanitizer Bypass in GitHub repository jgraph/drawio prior to 18.0.0. - Arbitrary (remote) code execution in the desktop app. - Stored XSS in the web app.
- Product
- jgraph/drawio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.