VULNERABILITY

CVE search

Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.

402.603 vulnerabilities · 1.766 actively exploited (CISA KEV)

drawio ✕Clear filters

27 results

ID	Severity	Summary	Published
CVE-2026-46642	MÉDIO6.1	draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.12, a crafted .drawio file can execute arbitrary JavaScript in the editor's origin when the file is opened. The vulnerability is not in the label sanitizer (which works correctly on the rendering path) but in a feature-detection	10/06/2026
CVE-2023-3975	CRÍTICO9.8	OS Command Injection in GitHub repository jgraph/drawio prior to 21.5.0.	27/07/2023
CVE-2023-3974	CRÍTICO9.8	OS Command Injection in GitHub repository jgraph/drawio prior to 21.4.0.	27/07/2023
CVE-2023-3973	MÉDIO6.1	Cross-site Scripting (XSS) - Reflected in GitHub repository jgraph/drawio prior to 21.6.3.