@highcharts highcharts

• CVE-2026-118255 High 8.4 Highcharts Grid: javascript: URL in credits.href runs script on click 0.3%
• CVE-2026-118254 High 8.6 Highcharts Grid: pagination language options are parsed as HTML 0.4%
• CVE-2026-118253 High 8.4 Highcharts Dashboards: fullscreen labels are parsed as HTML 0.4%
• CVE-2026-118252 High 8.4 Highcharts Dashboards: sidebar component labels are parsed as HTML 0.4%
• CVE-2026-118251 High 8.4 Highcharts: javascript: URL in credits.href runs script on click 0.4%
• CVE-2026-118250 High 7.2 Highcharts: dotted series.keys paths write to Object.prototype 0.4%
• CVE-2026-118249 High 7.2 Highcharts: series column construction writes to Object.prototype 0.4%
• CVE-2026-118248 Medium 6.9 Highcharts Dashboards: editableOptions.propertyPath writes to Object.prototype 0.3%
• CVE-2026-118247 Medium 6.9 Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column. 0.4%
• CVE-2026-118246 High 8.4 Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes 0.3%
• CVE-2026-118245 High 8.6 Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace 0.3%
• CVE-2026-118244 High 7.2 Highcharts Core: AST `DOMParser` fallback assigns unsanitized markup to `innerHTML` during print 0.3%
• CVE-2026-118243 Medium 5.3 Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype` 0.4%
• CVE-2026-118242 High 8.5 Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>` 0.3%
• CVE-2026-116797 High 8.5 Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute` 0.3%
• CVE-2026-116796 High 7.2 Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts 0.3%
• CVE-2021-29489 High 7.6 Options structure open to XSS if passed unfiltered 0.9%