https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T11:32:23.535122+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-42195 CVE-2026-42195 — Unvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled host 2026-10-09T11:32:23.550188+00:00

Affected: jgraph drawio

draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's "Authorize in GitLab" dialog to open a popup on the attacker-controlled host instead of gitlab.com. This can lead to credential fishing and session state token exfiltration. This issue has been patched in version 29.7.9.