CriticalCVSS 9.8
EPSS 2.3%
OS Command Injection in GitHub repository jgraph/drawio prior to 21.5.0.
Product
jgraph/drawio vulnerabilities
26 published CVES affecting jgraph/drawio, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 26
- Critical
- 3
- High
- 11
- Medium
- 11
- Low
- 1
- Unscored
- 0
- CISA KEV
- 0
Latest jgraph/drawio CVEs
Newest publication first · page 1 of 2
-
-
CriticalCVSS 9.8 EPSS 1.2%
OS Command Injection in GitHub repository jgraph/drawio prior to 21.4.0.
-
MediumCVSS 6.1 EPSS 0.40%
Cross-site Scripting (XSS) - Reflected in GitHub repository jgraph/drawio prior to 21.6.3.
-
HighCVSS 7.5 EPSS 0.97%
Denial of Service in GitHub repository jgraph/drawio prior to 18.1.3.
-
MediumCVSS 6.1 EPSS 0.53%
Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 21.2.8.
-
MediumCVSS 6.1 EPSS 0.91%
Cross-site Scripting (XSS) - DOM in GitHub repository jgraph/drawio prior to 20.5.2.
-
MediumCVSS 6.1 EPSS 0.82%
Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 20.3.1.
-
HighCVSS 7.8 EPSS 1.1%
OS Command Injection in GitHub repository jgraph/drawio prior to 20.3.0.
-
MediumCVSS 6.1 EPSS 0.68%
Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0.
-
MediumCVSS 6.1 EPSS 0.68%
Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0.
-
MediumCVSS 5.4 EPSS 0.65%
Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 20.2.8.
-
HighCVSS 7.5 EPSS 1.3%
Improper Access Control in GitHub repository jgraph/drawio prior to 20.2.8.
-
MediumCVSS 5.4 EPSS 0.65%
Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 19.0.2.
-
MediumCVSS 5.4 EPSS 0.75%
Code Injection in GitHub repository jgraph/drawio prior to 19.0.2.
-
HighCVSS 7.5 EPSS 5.4%
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.1.2.
-
HighCVSS 7.5 EPSS 1.8%
Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.8.
-
MediumCVSS 4.6 EPSS 0.62%
Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 18.0.4.
-
MediumCVSS 6.1 EPSS 1.2%
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.0.7.
-
HighCVSS 7.5 EPSS 1.8%
Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.7.
-
HighCVSS 8.8 EPSS 1.4%
Improper Input Validation in GitHub repository jgraph/drawio prior to 18.0.6.
-
HighCVSS 7.5 EPSS 5.8%
Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.5.
-
HighCVSS 7.5 EPSS 1.7%
Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.6.
-
HighCVSS 7.5 EPSS 9.6%
SSRF on /proxy in GitHub repository jgraph/drawio prior to 18.0.4. An attacker can make a request as the server and read its contents. This can lead to a leak of sensitive information.
-
HighCVSS 7.5 EPSS 2.3%
Path Traversal in WellKnownServlet in GitHub repository jgraph/drawio prior to 18.0.5. Read local files of the web application.
-
LowCVSS 3.3 EPSS 0.55%
SSRF in editor's proxy via IPv6 link-local address in GitHub repository jgraph/drawio prior to 18.0.5. SSRF to internal link-local IPv6 addresses
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.