Vulnerabilities
VEX
CWE
KEV Catalogs
All catalogs
CIRCL
CISA
ENISA
Shadowserver
Previdian
Community
Sightings
Comments
Bundles
Organizations
Contributors
Disclosure
Vulnerability Disclosures
Statistics
Log in
About
Search term
Success
GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference -
Registration
← All credits
hakupiku (Bugcrowd)
1 vulnerability record and advisories credit this contributor.
CVE-2026-85094
The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session.