jgraph has 5 CVEs on record. 5 were published in the last 90 days. The busiest recent month was September 2026 with 5. The median CVSS is 6.1 (medium). None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.1
- Publish → KEV
- —
- Last 90 days
- 5 prev 0
Worst active — by depth score
CVE-2026-76898High· 7.7draw.io is a configurable diagramming and whiteboarding application42CVE-2026-63334Medium· 6.8draw.io is a configurable diagramming and whiteboarding application37CVE-2026-58504Medium· 6.1draw.io is a configurable diagramming and whiteboarding application34CVE-2026-63373Medium· 4.2draw.io is a configurable diagramming and whiteboarding application23CVE-2026-63416Low· 3.7draw.io is a configurable diagramming and whiteboarding application20
jgraph vulnerabilities
CVEs affecting jgraph, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-58504Medium· 6.1draw.io is a configurable diagramming and whiteboarding application
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.5, opening or importing a crafted .drawio file can execute attacker-controlled JavaScript in the draw.io origin when selected cells are processed …
CVE-2026-63416Low· 3.7draw.io is a configurable diagramming and whiteboarding application
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, src/main/java/com/mxgraph/online/ExportProxyServlet.java uses request.getPathInfo() to build a proxyPath and appends it directly to EXPORT_URL …
CVE-2026-63334Medium· 6.8draw.io is a configurable diagramming and whiteboarding application
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, deployments with ENABLE_DRAWIO_PROXY=1 are vulnerable to server-side request forgery because src/main/java/com/mxgraph/online/Utils.java perfor…
CVE-2026-63373Medium· 4.2draw.io is a configurable diagramming and whiteboarding application
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, the OAuth callback handler in src/main/java/com/mxgraph/online/AbsAuth.java skips comparison of stateToken and cookieToken whenever IS_GAE is f…
CVE-2026-76898High· 7.7draw.io is a configurable diagramming and whiteboarding application
draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.3.8, src/main/java/com/mxgraph/online/Utils.java checks IPv6 Unique Local Addresses in Utils.sanitizeUrl() by comparing the text prefixes fc00:: and…