highcharts vulnerabilities

CVEs per yearBy the year they were published

1. 20211
2. 202616

Newest CVEs

• CVE-2026-118255

  Highcharts Grid: javascript: URL in credits.href runs script on click

  highcharts · highcharts

  High8.4
• CVE-2026-118254

  Highcharts Grid: pagination language options are parsed as HTML

  highcharts · highcharts

  High8.6
• CVE-2026-118253

  Highcharts Dashboards: fullscreen labels are parsed as HTML

  highcharts · highcharts

  High8.4
• CVE-2026-118252

  Highcharts Dashboards: sidebar component labels are parsed as HTML

  highcharts · highcharts

  High8.4
• CVE-2026-118251

  Highcharts: javascript: URL in credits.href runs script on click

  highcharts · highcharts

  High8.4
• CVE-2026-118250

  Highcharts: dotted series.keys paths write to Object.prototype

  highcharts · highcharts

  High7.2
• CVE-2026-118249

  Highcharts: series column construction writes to Object.prototype

  highcharts · highcharts

  High7.2
• CVE-2026-118248

  Highcharts Dashboards: editableOptions.propertyPath writes to Object.prototype

  highcharts · highcharts

  Medium6.9
• CVE-2026-118247

  Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column.

  highcharts · highcharts

  Medium6.9
• CVE-2026-118246

  Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes

  highcharts · highcharts

  High8.4