https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 19:05:21 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-373088 EUVD-2026-373088 https://cve.radiocsirt.org/vuln/euvd-2026-373088 https://cve.radiocsirt.org/vuln/fkie_cve-2026-63373 <p>draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, the OAuth callback handler in src/main/java/com/mxgraph/online/AbsAuth.java skips comparison of stateToken and cookieToken whenever IS_GAE is false, which affects self-hosted Docker and WAR deployments. An attacker can provide an authorization code for the attacker&#39;s cloud-storage identity and induce a victim to visit a callback URL, causing the victim&#39;s draw.io session to become authenticated as the attacker identity without a valid state binding. The shared handler affects Google Drive, OneDrive, GitHub, GitLab, and Dropbox integrations. The victim can then unknowingly perform cloud-storage actions under the attacker&#39;s identity, causing session integrity loss and misattribution, but the identity binding does not itself grant access to existing victim cloud files. This issue is fixed in version 30.2.7.</p> <p>draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, the OAuth callback handler in src/main/java/com/mxgraph/online/AbsAuth.java skips comparison of stateToken and cookieToken whenever IS_GAE is false, which affects self-hosted Docker and WAR deployments. An attacker can provide an authorization code for the attacker&#39;s cloud-storage identity and induce a victim to visit a callback URL, causing the victim&#39;s draw.io session to become authenticated as the attacker identity without a valid state binding. The shared handler affects Google Drive, OneDrive, GitHub, GitLab, and Dropbox integrations. The victim can then unknowingly perform cloud-storage actions under the attacker&#39;s identity, causing session integrity loss and misattribution, but the identity binding does not itself grant access to existing victim cloud files. This issue is fixed in version 30.2.7.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-63373 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3506 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in drawio ausnutzen, um Cross-Site-Scripting-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen und Daten zu manipulieren oder offenzulegen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in drawio ausnutzen, um Cross-Site-Scripting-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen und Daten zu manipulieren oder offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3506