Canva vulnerabilities
36 CVEs and advisories name Canva as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-113409The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripti
- CVE-2026-114173The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages.
- CVE-2026-113387The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public
- CVE-2026-103220The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing raster image dat
- CVE-2026-101130The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing arrays of string
- CVE-2026-101094The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle incomplete UTF-8 character sequences when par
- CVE-2026-96396The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not safely calculate the size of an image buffer when ge
- CVE-2026-96395The Affinity by Canva app for macOS before 3.3.1 (October 2026 release) did not perform adequate bounds checking when generating QuickLook t
- CVE-2026-96394The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not validate image dimensions against the size of the pi
- CVE-2026-96393The Affinity by Canva app before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing Affinity document files,
- CVE-2026-90860The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebVie
- CVE-2026-92839Canva Desktop before v1.125.0 performed double decoding in the deeplink handler.
- CVE-2026-81546The Affinity by Canva application before 3.3.0 (September 2026 release) did not perform adequate bounds checking when parsing Affinity docum
- CVE-2026-85094The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView.
- CVE-2026-85085The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView.
- CVE-2025-66342A type confusion vulnerability exists in the EMF functionality of Canva Affinity.
- CVE-2025-62500An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity.
- CVE-2025-61979An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity.
- CVE-2025-64733An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity.
- CVE-2025-66000An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity.
- CVE-2025-64301An out‑of‑bounds write vulnerability exists in the EMF functionality of Canva Affinity.
- CVE-2025-64776An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity.
- CVE-2025-64735An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity.
- CVE-2025-66633An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity.
- CVE-2025-58427An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity.
- CVE-2025-66617An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity.
- CVE-2025-47873An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity.
- CVE-2025-61952An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity.
- CVE-2025-66503An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity.
- CVE-2025-66042An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity.