CVE Program partner

Canva

Canva

API
CVEs, 365 days1212 all time, 0 rejected
Quality100%median 99%
CVSS by the CNA100%share of records
CWE100%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationCanva
RoleCNA
TypeVendor, Open Source, Researcher
Reports tomitre
ScopeAll Canva products, including open-source software published and maintained by Canva, as well as vulnerabilities in third-party software discovered by Canva that are not in another CNA’s scope.
Advisorieshttps://trust.canva.com/

Latest CVEs · RSS

  • CVE-2026-103220 2026-10-09 · CVSS 4.5
    The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing raster image data in Affinity docume
  • CVE-2026-101130 2026-10-09 · CVSS 3.6
    The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing arrays of strings in Affinity docume
  • CVE-2026-101094 2026-10-09 · CVSS 3.6
    The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle incomplete UTF-8 character sequences when parsing text in Affinit
  • CVE-2026-96396 2026-10-09 · CVSS 4.9
    The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not safely calculate the size of an image buffer when generating QuickLook t
  • CVE-2026-96395 2026-10-09 · CVSS 3.6
    The Affinity by Canva app for macOS before 3.3.1 (October 2026 release) did not perform adequate bounds checking when generating QuickLook thumbnails and previe
  • CVE-2026-96394 2026-10-09 · CVSS 2.9
    The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not validate image dimensions against the size of the pixel data when genera
  • CVE-2026-96393 2026-10-09 · CVSS 3.6
    The Affinity by Canva app before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing Affinity document files, leading to an out-o
  • CVE-2026-90860 2026-09-21 · CVSS 7.1
    The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor wi
  • CVE-2026-92839 2026-09-17 · CVSS 4.3
    Canva Desktop before v1.125.0 performed double decoding in the deeplink handler. A threat actor could cause the application to load arbitrary same-origin conten
  • CVE-2026-81546 2026-09-17 · CVSS 7.7
    The Affinity by Canva application before 3.3.0 (September 2026 release) did not perform adequate bounds checking when parsing Affinity document files leading to
  • CVE-2026-85094 2026-09-04 · CVSS 8.8
    The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control o
  • CVE-2026-85085 2026-09-04 · CVSS 9.6
    The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is

All CVE Program partners