HI
Vendor
highcharts
32
CVEs
0
On KEV
30
New 30D
Products
HI8.6
highcharts
highcharts
18 CVEs0 on KEV16 new
DA8.6
dashboards
@highcharts
7 CVEs0 on KEV7 new
GR8.6
grid-pro
@highcharts
5 CVEs0 on KEV5 new
GR8.6
grid-lite
@highcharts
2 CVEs0 on KEV2 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-118255 New | GR grid-pro @highcharts | 8.4 | Oct 28 | Highcharts Grid: javascript: URL in credits.href runs script on click |
| CVE-2026-118254 New | GR grid-pro @highcharts | 8.6 | Oct 28 | Highcharts Grid: pagination language options are parsed as HTML |
| CVE-2026-118253 New | DA dashboards @highcharts | 8.4 | Oct 28 | Highcharts Dashboards: fullscreen labels are parsed as HTML |
| CVE-2026-118252 New | DA dashboards @highcharts | 8.4 | Oct 28 | Highcharts Dashboards: sidebar component labels are parsed as HTML |
| CVE-2026-118251 New | HI highcharts highcharts | 8.4 | Oct 28 | Highcharts: javascript: URL in credits.href runs script on click |
| CVE-2026-118250 New | HI highcharts highcharts | 7.2 | Oct 28 | Highcharts: dotted series.keys paths write to Object.prototype |
| CVE-2026-118249 New | HI highcharts highcharts | 7.2 | Oct 28 | Highcharts: series column construction writes to Object.prototype |
| CVE-2026-118248 New | HI highcharts highcharts | 6.9 | Oct 28 | Highcharts Dashboards: editableOptions.propertyPath writes to Object.prototype |
| CVE-2026-118247 New | HI highcharts highcharts | 6.9 | Oct 28 | Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column. |
| CVE-2026-118246 New | HI highcharts highcharts | 8.4 | Oct 28 | Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes |
| CVE-2026-118245 New | HI highcharts highcharts | 8.6 | Oct 28 | Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace |
| CVE-2026-118244 New | HI highcharts highcharts | 7.2 | Oct 28 | Highcharts Core: AST `DOMParser` fallback assigns unsanitized markup to `innerHTML` during print |
| CVE-2026-118243 New | HI highcharts highcharts | 5.3 | Oct 28 | Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype` |
| CVE-2026-118242 New | HI highcharts highcharts | 8.5 | Oct 28 | Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>` |
| CVE-2026-116797 New | DA dashboards @highcharts | 8.5 | Oct 28 | Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute` |
| CVE-2026-116796 New | HI highcharts highcharts | 7.2 | Oct 28 | Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts |
| CVE-2021-29489 | HI Highcharts Highcharts | 5.4 | May 5 | Highcharts JS is a JavaScript charting library based on SVG |
| CVE-2018-20801 | HI Highcharts Highcharts | 7.5 | Mar 14 | In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a denial of service attack against the… |