https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 08:13:08 +0000 https://cve.radiocsirt.org/vuln/cve-2026-42195 <p><strong>Affected:</strong> jgraph drawio</p> <p>draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user&#39;s click on draw.io&#39;s &#34;Authorize in GitLab&#34; dialog to open a popup on the attacker-controlled host instead of gitlab.com. This can lead to credential fishing and session state token exfiltration. This issue has been patched in version 29.7.9.</p> <p><strong>Affected:</strong> jgraph drawio</p> <p>draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user&#39;s click on draw.io&#39;s &#34;Authorize in GitLab&#34; dialog to open a popup on the attacker-controlled host instead of gitlab.com. This can lead to credential fishing and session state token exfiltration. This issue has been patched in version 29.7.9.</p> https://cve.radiocsirt.org/vuln/cve-2026-42195