agentprime: jgraph-drawioEvery new CVE for jgraph-drawio.https://agentprime.io/CVE-2026-115762: draw.io: Prototype pollution in GraphML (mxGraphMlCodec)https://agentprime.io/advisories/CVE-2026-115762/https://agentprime.io/advisories/CVE-2026-115762/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 20:54:51 GMTCVECVE-2026-97373: draw.io: Incomplete SSRF blocklist in `ProxyServlet` / `Utils.sanitizeUrl`: RFC 6598 CGNAT range `100.64.0.0/10` is not blocked -> server-side request to internal CGNAT hostshttps://agentprime.io/advisories/CVE-2026-97373/https://agentprime.io/advisories/CVE-2026-97373/CVSS 5.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 20:52:51 GMTCVECVE-2026-76898: draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.jshttps://agentprime.io/advisories/CVE-2026-76898/https://agentprime.io/advisories/CVE-2026-76898/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 16:31:54 GMTCVECVE-2026-63373: draw.io: OAuth CSRF via missing state validation on self-hosted deployments allows session token injectionhttps://agentprime.io/advisories/CVE-2026-63373/https://agentprime.io/advisories/CVE-2026-63373/CVSS 4.2 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 16:29:43 GMTCVECVE-2026-63334: draw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklisthttps://agentprime.io/advisories/CVE-2026-63334/https://agentprime.io/advisories/CVE-2026-63334/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 16:22:59 GMTCVECVE-2026-63416: draw.io: Path traversal in ExportProxyServlet allows access to arbitrary backend endpointshttps://agentprime.io/advisories/CVE-2026-63416/https://agentprime.io/advisories/CVE-2026-63416/CVSS 3.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 16:18:39 GMTCVECVE-2026-58504: draw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642https://agentprime.io/advisories/CVE-2026-58504/https://agentprime.io/advisories/CVE-2026-58504/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 16:15:30 GMTCVECVE-2026-46642: draw.io: XSS via crafted cell label when opening a .drawio filehttps://agentprime.io/advisories/CVE-2026-46642/https://agentprime.io/advisories/CVE-2026-46642/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 10 Jun 2026 17:42:02 GMTCVECVE-2026-42195: Unvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled hosthttps://agentprime.io/advisories/CVE-2026-42195/https://agentprime.io/advisories/CVE-2026-42195/CVSS 3.4 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 08 May 2026 21:22:40 GMTCVECVE-2023-3975: OS Command Injection in jgraph/drawiohttps://agentprime.io/advisories/CVE-2023-3975/https://agentprime.io/advisories/CVE-2023-3975/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 27 Jul 2023 14:34:10 GMTCVECVE-2023-3974: OS Command Injection in jgraph/drawiohttps://agentprime.io/advisories/CVE-2023-3974/https://agentprime.io/advisories/CVE-2023-3974/CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 27 Jul 2023 14:33:31 GMTCVEcriticalCVE-2023-3973: Cross-site Scripting (XSS) - Reflected in jgraph/drawiohttps://agentprime.io/advisories/CVE-2023-3973/https://agentprime.io/advisories/CVE-2023-3973/CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 27 Jul 2023 14:33:11 GMTCVEcriticalCVE-2023-3398: Denial of Service in jgraph/drawiohttps://agentprime.io/advisories/CVE-2023-3398/https://agentprime.io/advisories/CVE-2023-3398/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 26 Jun 2023 10:05:09 GMTCVECVE-2023-3026: Cross-site Scripting (XSS) - Stored in jgraph/drawiohttps://agentprime.io/advisories/CVE-2023-3026/https://agentprime.io/advisories/CVE-2023-3026/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 01 Jun 2023 00:00:00 GMTCVECVE-2022-3873: Cross-site Scripting (XSS) - DOM in jgraph/drawiohttps://agentprime.io/advisories/CVE-2022-3873/https://agentprime.io/advisories/CVE-2022-3873/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 07 Nov 2022 00:00:00 GMTCVECVE-2022-3223: Cross-site Scripting (XSS) - Stored in jgraph/drawiohttps://agentprime.io/advisories/CVE-2022-3223/https://agentprime.io/advisories/CVE-2022-3223/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 16 Sep 2022 10:50:12 GMTCVECVE-2022-3133: OS Command Injection in jgraph/drawiohttps://agentprime.io/advisories/CVE-2022-3133/https://agentprime.io/advisories/CVE-2022-3133/CVSS 7.0 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 09 Sep 2022 17:55:09 GMTCVECVE-2022-3138: Cross-site Scripting (XSS) - Generic in jgraph/drawiohttps://agentprime.io/advisories/CVE-2022-3138/https://agentprime.io/advisories/CVE-2022-3138/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 08 Sep 2022 09:30:14 GMTCVECVE-2022-3148: Cross-site Scripting (XSS) - Generic in jgraph/drawiohttps://agentprime.io/advisories/CVE-2022-3148/https://agentprime.io/advisories/CVE-2022-3148/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 08 Sep 2022 09:25:09 GMTCVECVE-2022-3127: Cross-site Scripting (XSS) - Stored in jgraph/drawiohttps://agentprime.io/advisories/CVE-2022-3127/https://agentprime.io/advisories/CVE-2022-3127/CVSS 5.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Sep 2022 12:50:09 GMTCVECVE-2022-3065: Improper Access Control in jgraph/drawiohttps://agentprime.io/advisories/CVE-2022-3065/https://agentprime.io/advisories/CVE-2022-3065/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Sep 2022 18:15:12 GMTCVECVE-2022-2015: Cross-site Scripting (XSS) - Stored in jgraph/drawiohttps://agentprime.io/advisories/CVE-2022-2015/https://agentprime.io/advisories/CVE-2022-2015/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 08 Jun 2022 08:30:14 GMTCVECVE-2022-2014: Code Injection in jgraph/drawiohttps://agentprime.io/advisories/CVE-2022-2014/https://agentprime.io/advisories/CVE-2022-2014/CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 08 Jun 2022 07:25:11 GMTCVEcriticalCVE-2022-1815: Exposure of Sensitive Information to an Unauthorized Actor in jgraph/drawiohttps://agentprime.io/advisories/CVE-2022-1815/https://agentprime.io/advisories/CVE-2022-1815/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 25 May 2022 08:15:15 GMTCVECVE-2022-1784: Server-Side Request Forgery (SSRF) in jgraph/drawiohttps://agentprime.io/advisories/CVE-2022-1784/https://agentprime.io/advisories/CVE-2022-1784/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 20 May 2022 12:15:11 GMTCVECVE-2022-1730: Cross-site Scripting (XSS) - Stored in jgraph/drawiohttps://agentprime.io/advisories/CVE-2022-1730/https://agentprime.io/advisories/CVE-2022-1730/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 19 May 2022 13:55:12 GMTCVECVE-2022-1774: Exposure of Sensitive Information to an Unauthorized Actor in jgraph/drawiohttps://agentprime.io/advisories/CVE-2022-1774/https://agentprime.io/advisories/CVE-2022-1774/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 18 May 2022 20:40:10 GMTCVECVE-2022-1767: Server-Side Request Forgery (SSRF) in jgraph/drawiohttps://agentprime.io/advisories/CVE-2022-1767/https://agentprime.io/advisories/CVE-2022-1767/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 18 May 2022 15:45:11 GMTCVECVE-2022-1727: Improper Input Validation in jgraph/drawiohttps://agentprime.io/advisories/CVE-2022-1727/https://agentprime.io/advisories/CVE-2022-1727/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 18 May 2022 10:25:12 GMTCVECVE-2022-1711: Server-Side Request Forgery (SSRF) in jgraph/drawiohttps://agentprime.io/advisories/CVE-2022-1711/https://agentprime.io/advisories/CVE-2022-1711/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 17 May 2022 12:40:09 GMTCVECVE-2022-1723: Server-Side Request Forgery (SSRF) in jgraph/drawiohttps://agentprime.io/advisories/CVE-2022-1723/https://agentprime.io/advisories/CVE-2022-1723/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 17 May 2022 08:35:10 GMTCVECVE-2022-1713: SSRF on /proxy in jgraph/drawiohttps://agentprime.io/advisories/CVE-2022-1713/https://agentprime.io/advisories/CVE-2022-1713/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 16 May 2022 14:31:52 GMTCVECVE-2022-1721: Path Traversal in WellKnownServlet in jgraph/drawiohttps://agentprime.io/advisories/CVE-2022-1721/https://agentprime.io/advisories/CVE-2022-1721/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 16 May 2022 14:31:26 GMTCVECVE-2022-1722: SSRF in editor's proxy via IPv6 link-local address in jgraph/drawiohttps://agentprime.io/advisories/CVE-2022-1722/https://agentprime.io/advisories/CVE-2022-1722/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 16 May 2022 14:31:21 GMTCVECVE-2022-1575: Arbitrary Code Execution through Sanitizer Bypass in jgraph/drawiohttps://agentprime.io/advisories/CVE-2022-1575/https://agentprime.io/advisories/CVE-2022-1575/CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 May 2022 11:45:12 GMTCVEcritical