Skip to content
OpenAdvisories

Vendor

canva

36 known vulnerabilities.

Products

affinity 27 Canva 5 ortto 3 Canva – Design beautiful blog graphics 1
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 8.6
    CVE-2026-113387

    The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secr…

    canva ortto Web / CMS
  • High 7.1
    CVE-2026-90860

    The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running i…

    canva Canva
  • High 7.7
    CVE-2026-81546

    The Affinity by Canva application before 3.3.0 (September 2026 release) did not perform adequate bounds checking when p…

    canva affinity
  • High 8.8
    CVE-2026-85094

    The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privilege…

    canva Canva
  • High 7.8
    CVE-2025-66342

    A type confusion vulnerability exists in the EMF functionality of Canva Affinity. A specially crafted EMF file can trig…

    canva affinity
  • High 7.8
    CVE-2025-64301

    An out‑of‑bounds write vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EM…

    canva affinity
  • High 7.1
    CVE-2024-32545

    WordPress Canva – Design beautiful blog graphics plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Canva Canva – Design beautiful blog graphics allows Reflected XSS.This issue affects Canva – Design beautiful blog graphics: from n/a through 1.2.4.

    canva Canva – Design beautiful blog graphics