226 matches found
Drawio <18.1.2 - Server-Side Request Forgery
Drawio before 18.1.2 is susceptible to server-side request forgery via the /service endpoint in jgraph/drawio. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2022-1815 info: nam...
draw.io < 18.0.5 - Server Side Request Forgery (SSRF)
Server-Side Request Forgery SSRF vulnerability in draw.io also known as diagrams.net prior to version 18.0.5 allows attackers to bypass URL validation restrictions in the ProxyServlet component. The vulnerability exists because the application does not properly validate URLs passed to its proxy...
Drawio <18.0.4 - Server-Side Request Forgery
Drawio prior to 18.0.4 is vulnerable to server-side request forgery. An attacker can make a request as the server and read its contents. This can lead to a leak of sensitive information. id: CVE-2022-1713 info: name: Drawio 18.0.4 - Server-Side Request Forgery author: pikpikcu severity: high...
CVE-2026-46642
CVE-2026-46642 affects draw.io prior to 29.7.12. A crafted .drawio file can execute arbitrary JavaScript in the editor’s origin when opened. The root cause is a feature-detection routine in the Text Format panel that reads the raw cell label and assigns it to a detached element’s innerHTML withou...
EUVD-2026-36077
draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.12, a crafted .drawio file can execute arbitrary JavaScript in the editor's origin when the file is opened. The vulnerability is not in the label sanitizer which works correctly on the rendering path but in...
CVE-2026-46642 draw.io: XSS via crafted cell label when opening a .drawio file
draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.12, a crafted .drawio file can execute arbitrary JavaScript in the editor's origin when the file is opened. The vulnerability is not in the label sanitizer which works correctly on the rendering path but in...
CVE-2026-40608
Next AI Draw.io is a next.js web application that integrates AI capabilities with draw.io diagrams. Prior to 0.4.15, the embedded HTTP sidecar contains three POST handlers /api/state, /api/restore, and /api/history-svg that process incoming requests by accumulating the entire request body into a...
CVE-2026-40608
CVE-2026-40608 affects Next AI Draw.io (a Next.js app). Before version 0.4.15, the embedded HTTP sidecar’s three POST handlers (/api/state, /api/restore, /api/history-svg) accumulate entire request bodies into a JavaScript string without size limits. Node.js buffers the full payload in the V8 hea...
CVE-2026-40608 Next AI Draw.io: Unbounded HTTP Body — Denial of Service
Next AI Draw.io is a next.js web application that integrates AI capabilities with draw.io diagrams. Prior to 0.4.15, the embedded HTTP sidecar contains three POST handlers /api/state, /api/restore, and /api/history-svg that process incoming requests by accumulating the entire request body into a...
PT-2026-33689
Next AI Draw.io is a next.js web application that integrates AI capabilities with draw.io diagrams. Prior to 0.4.15, the embedded HTTP sidecar contains three POST handlers /api/state, /api/restore, and /api/history-svg that process incoming requests by accumulating the entire request body into a...
EUVD-2022-42560
Malicious code in bioql PyPI...
EUVD-2022-25064
Malicious code in bioql PyPI...
EUVD-2022-42572
Malicious code in bioql PyPI...
EUVD-2022-25005
Malicious code in bioql PyPI...
EUVD-2022-43210
Malicious code in bioql PyPI...
EUVD-2023-44599
Malicious code in bioql PyPI...
EUVD-2022-25003
Malicious code in bioql PyPI...
EUVD-2022-42496
Malicious code in bioql PyPI...
EUVD-2022-42636
Malicious code in bioql PyPI...
EUVD-2022-34320
Malicious code in bioql PyPI...