Known vulnerabilities
| CVE | Title | Affected versions | CVSS | Exploited | EPSS | Published |
|---|---|---|---|---|---|---|
| CVE-2026-115762 | draw.io: Prototype pollution in GraphML (mxGraphMlCodec) | * | 6.1 | — | 2026-11-05 | |
| CVE-2026-97373 | draw.io: Incomplete SSRF blocklist in `ProxyServlet` / `Utils.sanitizeUrl`: RFC 6598 CGNAT range `100.64.0.0/1... | * | 5.8 | — | 2026-11-05 | |
| CVE-2026-76898 | draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js | * | 7.7 | — | 2026-09-22 | |
| CVE-2026-63373 | draw.io: OAuth CSRF via missing state validation on self-hosted deployments allows session token injection | * | 4.2 | — | 2026-09-22 | |
| CVE-2026-63334 | draw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklist | * | 6.8 | — | 2026-09-22 | |
| CVE-2026-63416 | draw.io: Path traversal in ExportProxyServlet allows access to arbitrary backend endpoints | * | 3.7 | — | 2026-09-22 | |
| CVE-2026-58504 | draw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642 | * | 6.1 | — | 2026-09-22 | |
| CVE-2026-46642 | draw.io: XSS via crafted cell label when opening a .drawio file | * | 6.1 | — | 2026-06-11 | |
| CVE-2026-42195 | Unvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled host | * | 3.4 | — | 2026-05-09 | |
| CVE-2023-3975 | OS Command Injection in jgraph/drawio | * | 8.3 | — | 2023-07-27 | |
| CVE-2023-3974 | OS Command Injection in jgraph/drawio | * | 9.6 | — | 2023-07-27 | |
| CVE-2023-3973 | Cross-site Scripting (XSS) - Reflected in jgraph/drawio | * | 9.6 | — | 2023-07-27 | |
| CVE-2023-3398 | Denial of Service in jgraph/drawio | * | 5.3 | — | 2023-06-26 | |
| CVE-2023-3026 | Cross-site Scripting (XSS) - Stored in jgraph/drawio | * | 6.5 | — | 2023-06-01 | |
| CVE-2022-3873 | Cross-site Scripting (XSS) - DOM in jgraph/drawio | * | 6.5 | — | 2022-11-07 | |
| CVE-2022-3223 | Cross-site Scripting (XSS) - Stored in jgraph/drawio | * | 4.3 | — | 2022-09-16 | |
| CVE-2022-3133 | OS Command Injection in jgraph/drawio | * | 7.0 | — | 2022-09-10 | |
| CVE-2022-3138 | Cross-site Scripting (XSS) - Generic in jgraph/drawio | * | 4.3 | — | 2022-09-08 | |
| CVE-2022-3148 | Cross-site Scripting (XSS) - Generic in jgraph/drawio | * | 5.3 | — | 2022-09-08 | |
| CVE-2022-3127 | Cross-site Scripting (XSS) - Stored in jgraph/drawio | * | 5.5 | — | 2022-09-05 | |
| CVE-2022-3065 | Improper Access Control in jgraph/drawio | * | 5.3 | — | 2022-09-03 | |
| CVE-2022-2015 | Cross-site Scripting (XSS) - Stored in jgraph/drawio | * | 6.1 | — | 2022-06-08 | |
| CVE-2022-2014 | Code Injection in jgraph/drawio | * | 9.6 | — | 2022-06-08 | |
| CVE-2022-1815 | Exposure of Sensitive Information to an Unauthorized Actor in jgraph/drawio | * | 5.3 | — | 2022-05-25 | |
| CVE-2022-1784 | Server-Side Request Forgery (SSRF) in jgraph/drawio | * | 7.5 | — | 2022-05-20 | |
| CVE-2022-1730 | Cross-site Scripting (XSS) - Stored in jgraph/drawio | * | 6.3 | — | 2022-05-19 | |
| CVE-2022-1774 | Exposure of Sensitive Information to an Unauthorized Actor in jgraph/drawio | * | 8.2 | — | 2022-05-19 | |
| CVE-2022-1767 | Server-Side Request Forgery (SSRF) in jgraph/drawio | * | 7.5 | — | 2022-05-19 | |
| CVE-2022-1727 | Improper Input Validation in jgraph/drawio | * | 8.3 | — | 2022-05-18 | |
| CVE-2022-1711 | Server-Side Request Forgery (SSRF) in jgraph/drawio | * | 7.5 | — | 2022-05-17 | |
| CVE-2022-1723 | Server-Side Request Forgery (SSRF) in jgraph/drawio | * | 7.5 | — | 2022-05-17 | |
| CVE-2022-1713 | SSRF on /proxy in jgraph/drawio | * | 7.5 | — | 2022-05-16 | |
| CVE-2022-1721 | Path Traversal in WellKnownServlet in jgraph/drawio | * | 7.5 | — | 2022-05-16 | |
| CVE-2022-1722 | SSRF in editor's proxy via IPv6 link-local address in jgraph/drawio | * | 7.5 | — | 2022-05-16 | |
| CVE-2022-1575 | Arbitrary Code Execution through Sanitizer Bypass in jgraph/drawio | * | 9.6 | — | 2022-05-05 |
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.
Data: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (see EPSS at https://www.first.org/epss), endoflife.date. Software list: awesome-selfhosted (CC BY-SA 3.0).