jgraph drawio

• CVE-2026-115762 Medium 6.1 draw.io: Prototype pollution in GraphML (mxGraphMlCodec) 0.2%
• CVE-2026-97373 Medium 5.8 draw.io: Incomplete SSRF blocklist in `ProxyServlet` / `Utils.sanitizeUrl`: RFC 6598 CGNAT range `100.64.0.0/10` is not blocked -> server-side request to internal CGNAT hosts 0.2%
• CVE-2026-76898 High 7.7 draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js 0.4%
• CVE-2026-63373 Medium 4.2 draw.io: OAuth CSRF via missing state validation on self-hosted deployments allows session token injection 0.2%
• CVE-2026-63334 Medium 6.8 draw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklist 0.3%
• CVE-2026-63416 Low 3.7 draw.io: Path traversal in ExportProxyServlet allows access to arbitrary backend endpoints 0.3%
• CVE-2026-58504 Medium 6.1 draw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642 0.2%
• CVE-2026-46642 Medium 6.1 draw.io: XSS via crafted cell label when opening a .drawio file 0.2%
• CVE-2026-42195 Low 3.4 Unvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled host 0.2%