@highcharts dashboards

• CVE-2026-118255 High 8.4 Highcharts Grid: javascript: URL in credits.href runs script on click 0.3%
• CVE-2026-118253 High 8.4 Highcharts Dashboards: fullscreen labels are parsed as HTML 0.4%
• CVE-2026-118252 High 8.4 Highcharts Dashboards: sidebar component labels are parsed as HTML 0.4%
• CVE-2026-118248 Medium 6.9 Highcharts Dashboards: editableOptions.propertyPath writes to Object.prototype 0.3%
• CVE-2026-118247 Medium 6.9 Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column. 0.4%
• CVE-2026-118245 High 8.6 Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace 0.3%
• CVE-2026-116797 High 8.5 Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute` 0.3%