Canva

4 known vulnerabilities in Canva, 1 critical, with patch priority, exploit likelihood and the news covering them.

Latest vulnerabilities

  • CVE-2026-90860 CVSS 7.1 high The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged…
  • CVE-2026-92839 CVSS 4.3 medium Canva Desktop before v1.125.0 performed double decoding in the deeplink handler. A threat actor could cause the application to load…
  • CVE-2026-85094 CVSS 8.8 high The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat…
  • CVE-2026-85085 CVSS 9.6 critical The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page…