[ Vendor · 25 CVEs ]
highcharts
CVEs affecting highcharts published in the last 30 days, plus any highcharts CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-118251 | 28 Oct 2026 | CVSS 8.4 | Highcharts: `javascript:` URL in credits.href runs script on clickHighcharts JS is a JavaScript charting library based on SVG. Prior to 11.4.9, 12.6.1, and 13.1.0, Highcharts assigns credits.href to the window… | Fix |
| CVE-2026-118252 | 28 Oct 2026 | CVSS 8.4 | Highcharts Dashboards parses sidebar component labels as HTMLHighcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit-mode sidebar parses component… | Fix |
| CVE-2026-118252 | 28 Oct 2026 | CVSS 8.4 | Highcharts Dashboards parses sidebar component labels as HTMLHighcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit-mode sidebar parses component… | Fix |
| CVE-2026-118253 | 28 Oct 2026 | CVSS 8.4 | Highcharts Dashboards parses fullscreen labels as HTMLHighcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit mode parses fullscreen language… | Fix |
| CVE-2026-118253 | 28 Oct 2026 | CVSS 8.4 | Highcharts Dashboards parses fullscreen labels as HTMLHighcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit mode parses fullscreen language… | Fix |
| CVE-2026-118254 | 28 Oct 2026 | CVSS 8.6 | Highcharts Grid parses pagination language options as HTMLHighcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid writes pagination language strings into the DOM… | Fix |
| CVE-2026-118254 | 28 Oct 2026 | CVSS 8.6 | Highcharts Grid parses pagination language options as HTMLHighcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid writes pagination language strings into the DOM… | Fix |
| CVE-2026-118255 | 28 Oct 2026 | CVSS 8.4 | Highcharts Grid: `javascript:` URL in credits.href runs script on clickHighcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid applies credits.href to the credits link without… | Fix |
| CVE-2026-118255 | 28 Oct 2026 | CVSS 8.4 | Highcharts Grid: `javascript:` URL in credits.href runs script on clickHighcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid applies credits.href to the credits link without… | Fix |
| CVE-2026-118249 | 28 Oct 2026 | CVSS 7.2 | Highcharts: series column construction writes to Object.prototypeHighcharts JS is a JavaScript charting library based on SVG. From 13.0.0 until 13.1.0, Highcharts builds series data columns by using point option… | Fix |
| CVE-2026-118250 | 28 Oct 2026 | CVSS 7.2 | Highcharts: dotted series.keys paths write to Object.prototypeHighcharts JS is a JavaScript charting library based on SVG. From 6.1.0 until 11.4.9, 12.6.1, and 3.1.0, Highcharts follows dot-separated series.keys… | Fix |
| CVE-2026-118243 | 28 Oct 2026 | CVSS 5.3 | Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype`Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards stores DataCursor listener and state maps… | Fix |
| CVE-2026-118244 | 28 Oct 2026 | CVSS 7.2 | Highcharts Core: HTML text parsing falls back to unfiltered `innerHTML` during printingHighcharts JS is a JavaScript charting library based on SVG. From 12.0.0 until 12.6.1 and 13.1.0, Highcharts falls back to assigning raw markup to… | Fix |
| CVE-2026-118245 | 28 Oct 2026 | CVSS 8.6 | Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespaceHighcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards uses chartConstructor as an unchecked… | Fix |
| CVE-2026-118245 | 28 Oct 2026 | CVSS 8.6 | Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespaceHighcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards uses chartConstructor as an unchecked… | Fix |
| CVE-2026-118246 | 28 Oct 2026 | CVSS 8.4 | Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributesHighcharts JS is a JavaScript charting library based on SVG. From 10.0.0 until 11.4.9, 12.6.1, and 13.1.0, Highcharts applies breadcrumbs.style as… | Fix |
| CVE-2026-118247 | 28 Oct 2026 | CVSS 6.9 | Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column.Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until Dashboards 4.2.2, and from 2.0.0 until Grid Pro 3.2.0, Highcharts… | Fix |
| CVE-2026-118247 | 28 Oct 2026 | CVSS 6.9 | Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column.Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until Dashboards 4.2.2, and from 2.0.0 until Grid Pro 3.2.0, Highcharts… | Fix |
| CVE-2026-118248 | 28 Oct 2026 | CVSS 6.9 | highchartsHighcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards edit mode walks editableOptions… | |
| CVE-2026-118248 | 28 Oct 2026 | CVSS 6.9 | highchartsHighcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards edit mode walks editableOptions… | |
| CVE-2026-116796 | 28 Oct 2026 | CVSS 7.2 | Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported chartsHighcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor… | Fix |
| CVE-2026-116797 | 28 Oct 2026 | CVSS 8.5 | Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid Pro input renderers copy the… | Fix |
| CVE-2026-116797 | 28 Oct 2026 | CVSS 8.5 | Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid Pro input renderers copy the… | Fix |
| CVE-2026-118242 | 28 Oct 2026 | CVSS 8.5 | Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`Highcharts JS is a JavaScript charting library based on SVG. From 2.3.0 until 3.2.0, Highcharts Grid creates SVG path elements from rendering.icons… | Fix |
| CVE-2026-118242 | 28 Oct 2026 | CVSS 8.5 | Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`Highcharts JS is a JavaScript charting library based on SVG. From 2.3.0 until 3.2.0, Highcharts Grid creates SVG path elements from rendering.icons… | Fix |