Vulnerabilities in jgraph
33 resultsCVE-2022-2015MEDIUMCross-site Scripting (XSS) - Stored in jgraph/drawioEPSS 0.6%CVE-2022-3127MEDIUMCross-site Scripting (XSS) - Stored in jgraph/drawioEPSS 0.6%CVE-2022-1730MEDIUMCross-site Scripting (XSS) - Stored in jgraph/drawioEPSS 0.6%CVE-2022-1722HIGHSSRF in editor's proxy via IPv6 link-local address in jgraph/drawioEPSS 0.5%CVE-2023-3026MEDIUMCross-site Scripting (XSS) - Stored in jgraph/drawioEPSS 0.5%CVE-2023-3973CRITICALCross-site Scripting (XSS) - Reflected in jgraph/drawioEPSS 0.4%CVE-2026-76898HIGHdraw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.jsEPSS 0.4%CVE-2026-63416LOWdraw.io: Path traversal in ExportProxyServlet allows access to arbitrary backend endpointsEPSS 0.3%CVE-2026-46642MEDIUMdraw.io: XSS via crafted cell label when opening a .drawio fileEPSS 0.3%CVE-2026-63334MEDIUMdraw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklistEPSS 0.3%CVE-2026-42195LOWUnvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled hostEPSS 0.3%CVE-2026-58504MEDIUMdraw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642EPSS 0.3%CVE-2026-63373MEDIUMdraw.io: OAuth CSRF via missing state validation on self-hosted deployments allows session token injectionEPSS 0.2%