Canva vulnerabilities
36 published CVEs name Canva among the affected products.
- Published CVEs
- 36
- Last 12 months
- 35
- Critical
- 1
- Known exploited
- 0
Critical 1High 7Medium 22Low 6Not scored 0
CVEs per yearBy the year they were published
- 20241
- 20251
- 202634
Newest CVEs
- CVE-2026-113409
The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting. A threat actor…
canva · ortto
Medium4.8 - CVE-2026-114173
The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat…
canva · ortto
Medium5.3 - CVE-2026-113387
The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An…
canva · ortto
High8.6 - CVE-2026-103220
The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing raster image data in Affinity…
canva · affinity
Medium4.5 - CVE-2026-101130
The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing arrays of strings in Affinity…
canva · affinity
Low3.6 - CVE-2026-101094
The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle incomplete UTF-8 character sequences when parsing text in…
canva · affinity
Low3.6 - CVE-2026-96396
The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not safely calculate the size of an image buffer when generating QuickLook…
canva · affinity
Medium4.9 - CVE-2026-96395
The Affinity by Canva app for macOS before 3.3.1 (October 2026 release) did not perform adequate bounds checking when generating QuickLook thumbnails and…
canva · affinity
Low3.6 - CVE-2026-96394
The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not validate image dimensions against the size of the pixel data when…
canva · affinity
Low2.9 - CVE-2026-96393
The Affinity by Canva app before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing Affinity document files, leading to an…
canva · affinity
Low3.6