Skip to content
@highcharts vulnerabilities
Newest
-
highcharts, @highcharts dashboards, grid-pro +2 more
Highcharts Grid: javascript: URL in credits.href runs script on click
CVE-2026-118255
Fix available
8.4 High
-
highcharts, @highcharts grid-lite, grid-pro +2 more
Highcharts Grid: pagination language options are parsed as HTML
CVE-2026-118254
Fix available
8.6 High
-
@highcharts dashboards, highcharts +1 more
Highcharts Dashboards: fullscreen labels are parsed as HTML
CVE-2026-118253
Fix available
8.4 High
-
@highcharts dashboards, highcharts +1 more
Highcharts Dashboards: sidebar component labels are parsed as HTML
CVE-2026-118252
Fix available
8.4 High
-
@highcharts dashboards, highcharts +1 more
Highcharts Dashboards: editableOptions.propertyPath writes to Object.prototype
CVE-2026-118248
6.9 Medium
-
@highcharts dashboards, highcharts, @highcharts grid-pro +2 more
Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column.
CVE-2026-118247
Fix available
6.9 Medium
-
@highcharts dashboards, highcharts +1 more
Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace
CVE-2026-118245
Fix available
8.6 High
-
highcharts, @highcharts grid-lite, grid-pro +2 more
Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`
CVE-2026-118242
Fix available
8.5 High
-
highcharts, @highcharts dashboards, grid-pro +2 more
Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`
CVE-2026-116797
Fix available
8.5 High