Browse CVEs

MEDIUM 6.1 CVE-2026-46642 draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.12, a crafted .drawio file can execute arbitrary JavaScrip… Drawio 29.7.12+ Fix from $1,6002026-06-10 CRITICAL 9.8 CVE-2023-3974 OS Command Injection in GitHub repository jgraph/drawio prior to 21.4.0. Drawio 21.4.0+ Fix from $2,3002023-07-27 CRITICAL 9.8 CVE-2023-3975 OS Command Injection in GitHub repository jgraph/drawio prior to 21.5.0. Drawio 21.5.0+ Fix from $2,3002023-07-27 MEDIUM 6.1 CVE-2023-3973 Cross-site Scripting (XSS) - Reflected in GitHub repository jgraph/drawio prior to 21.6.3. Drawio 21.6.3+ Fix from $1,6002023-07-27 HIGH 7.5 CVE-2023-3398 Denial of Service in GitHub repository jgraph/drawio prior to 18.1.3. Drawio 18.1.3+ Fix from $1,9502023-06-26 MEDIUM 6.1 CVE-2023-3026 Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 21.2.8. Drawio 21.2.8+ Fix from $1,6002023-06-01 MEDIUM 6.1 CVE-2022-3873 Cross-site Scripting (XSS) - DOM in GitHub repository jgraph/drawio prior to 20.5.2. Drawio 20.5.2+ Fix from $1,6002022-11-07 MEDIUM 6.1 CVE-2022-3223 Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 20.3.1. Drawio 20.3.1+ Fix from $1,6002022-09-16 HIGH 7.8 CVE-2022-3133 OS Command Injection in GitHub repository jgraph/drawio prior to 20.3.0. Drawio 20.3.0+ Fix from $1,9502022-09-09 MEDIUM 6.1 CVE-2022-3138 Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0. Drawio 20.3.0+ Fix from $1,6002022-09-08 MEDIUM 6.1 CVE-2022-3148 Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0. Drawio 20.3.0+ Fix from $1,6002022-09-08 MEDIUM 5.4 CVE-2022-3127 Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 20.2.8. Drawio 20.2.8+ Fix from $1,6002022-09-05 HIGH 7.5 CVE-2022-3065 Improper Access Control in GitHub repository jgraph/drawio prior to 20.2.8. Drawio 20.2.8+ Fix from $1,9502022-09-02 MEDIUM 5.4 CVE-2022-2014 Code Injection in GitHub repository jgraph/drawio prior to 19.0.2. Drawio 19.0.2+ Fix from $1,6002022-06-09 MEDIUM 5.4 CVE-2022-2015 Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 19.0.2. Drawio 19.0.2+ Fix from $1,6002022-06-09 HIGH 7.5 CVE-2022-1815EPSS 6% Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.1.2. Drawio 18.1.2+ Fix from $1,9502022-05-25 HIGH 7.5 CVE-2022-1784 Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.8. Drawio 18.0.8+ Fix from $1,9502022-05-20 MEDIUM 6.1 CVE-2022-1774 Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.0.7. Drawio 18.0.7+ Fix from $1,6002022-05-18 HIGH 7.5 CVE-2022-1767 Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.7. Drawio 18.0.7+ Fix from $1,9502022-05-18 HIGH 8.8 CVE-2022-1727 Improper Input Validation in GitHub repository jgraph/drawio prior to 18.0.6. Drawio 18.0.6+ Fix from $1,9502022-05-18 HIGH 7.5 CVE-2022-1711EPSS 6% Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.5. Drawio 18.0.5+ Fix from $1,9502022-05-17 HIGH 7.5 CVE-2022-1723 Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.6. Drawio 18.0.6+ Fix from $1,9502022-05-17 HIGH 7.5 CVE-2022-1713EPSS 10% SSRF on /proxy in GitHub repository jgraph/drawio prior to 18.0.4. An attacker can make a request as the server and read its contents. This can lead … Drawio 18.0.4+ Fix from $1,9502022-05-16 HIGH 7.5 CVE-2022-1721 Path Traversal in WellKnownServlet in GitHub repository jgraph/drawio prior to 18.0.5. Read local files of the web application. Drawio 18.0.5+ Fix from $1,9502022-05-16 CRITICAL 9.6 CVE-2022-1575 Arbitrary Code Execution through Sanitizer Bypass in GitHub repository jgraph/drawio prior to 18.0.0. - Arbitrary (remote) code execution in the desk… Drawio 18.0.0+ Fix from $2,3002022-05-05