CVE-2026-85085

CRITICAL9.6

Published 2026-09-04 · Source 61adb53e-e4b3-47f7-8a93-4717c9e77dc6

Description

The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicate with Canva using the user’s session.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

CWE-940

References

https://trust.canva.com/?tcuUid=be2ebc32-7053-4885-bf71-68771aa4589a

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-70403
XING CPTrans-ME-X contains a Use of Hard-coded Password (CWE-259). Anyone with the knowledge of the credential may log in to the affected device.
2026-09-04 · score 9.8
CVE-2026-69657
XING CPTrans-ME-X contains a Use of Default Password (CWE-1393). Anyone with the knowledge of the credential may log in to the affected device.
2026-09-04 · score 9.8
CVE-2026-62928
XING CPTrans-ME-X contains an OS Command Injection (CWE-78). Unauthenticated OS command may be injected.
2026-09-04 · score 9.8
CVE-2026-15354
The ACPT (Premium) plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.66. This is due to missing authorization in the `submit()` function, which allows unauthenticated form submissions to control the target user ID before calling `wp_update_user()`. This makes it possible for unauthenticated attackers to overwrite any WordPress user's email address and password, including an administrator's, and take over the account. Successful exploitation requires a public ACPT user form that permits anonymous submissions.
2026-09-04 · score 9.8
CVE-2026-85509
FreeIPMI before 1.6.19 has a stack-based buffer overflow in _read_fru_data in libfreeipmi/fru/ipmi-fru.c when a BMC returns more bytes than requested.
2026-09-04 · score 9.8