Advisories · Technology

Canva.

Every CVE that names Canva among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-90860 CVE record

CVSS 7.1 High

Canva: The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned…
- Canva
- CWE-212
Not analysed yet 21 Sept 2026
CVE-2026-92839 CVE record

CVSS 4.3 Medium

Canva Desktop before v1.125.0 performed double decoding in the deeplink handler.
- Canva
- CWE-174
Not analysed yet 17 Sept 2026
CVE-2026-85094 CVE record

CVSS 8.8 High

Canva: The Canva Android App before 2.376.0 did not restrict the headers returned to an external…
- Canva
- CWE-212
Not analysed yet 4 Sept 2026
CVE-2026-85085 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Canva: The Canva Android App before 2.376.0 allowed an external origin to be loaded in a…
- Canva
- CWE-940
Not analysed yet 4 Sept 2026
CVE-2025-12792 CVE record

CVSS 3.2 Low

Incorrect default permissions in Canva
- Canva
- Broken access control
Not analysed yet 18 Nov 2025