HI
Product
highcharts
18
CVEs
0
On KEV
8.6
Max CVSS
16
New 30D
Severity mix
Critical 0High 14Medium 4Low 0
Watch
Add highcharts to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-118254 New | 8.6 | Oct 28 | Highcharts Grid: pagination language options are parsed as HTML Affected: < 13.0.0-beta.2 |
| CVE-2026-118245 New | 8.6 | Oct 28 | Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace Affected: < 13.1.0 |
| CVE-2026-118242 New | 8.5 | Oct 28 | Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>` Affected: < 13.1.0 |
| CVE-2026-116797 New | 8.5 | Oct 28 | Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute` Affected: >= 2.0.0, < 3.2.0 |
| CVE-2026-118255 New | 8.4 | Oct 28 | Highcharts Grid: javascript: URL in credits.href runs script on click Affected: < 13.0.0-beta.2 |
| CVE-2026-118253 New | 8.4 | Oct 28 | Highcharts Dashboards: fullscreen labels are parsed as HTML Affected: < 13.0.0-beta.2 |
| CVE-2026-118252 New | 8.4 | Oct 28 | Highcharts Dashboards: sidebar component labels are parsed as HTML Affected: < 13.0.0-beta.2 |
| CVE-2026-118251 New | 8.4 | Oct 28 | Highcharts: javascript: URL in credits.href runs script on click Affected: < 11.4.9; >= 12.0.0, < 12.6.1; >= 13.0.0, < 13.1.1 |
| CVE-2026-118246 New | 8.4 | Oct 28 | Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes Affected: >= 10.0.0, < 11.4.9; >= 12.0.0, < 12.6.1; >= 13.0.0, < 13.1.1 |
| CVE-2018-20801 | 7.5 | Mar 14 | In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a denial of service attack against the… Affected: before 6.1.0 |
| CVE-2026-118250 New | 7.2 | Oct 28 | Highcharts: dotted series.keys paths write to Object.prototype Affected: >= 6.1.0, < 11.4.9; >= 12.0.0, < 12.6.1; >= 13.0.0, < 13.1.0 |
| CVE-2026-118249 New | 7.2 | Oct 28 | Highcharts: series column construction writes to Object.prototype Affected: >= 13.0.0, < 13.1.0 |
| CVE-2026-118244 New | 7.2 | Oct 28 | Highcharts Core: AST `DOMParser` fallback assigns unsanitized markup to `innerHTML` during print Affected: >= 12.0.0, < 12.6.1; >= 13.0.0, < 13.1.0 |
| CVE-2026-116796 New | 7.2 | Oct 28 | Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts Affected: >= 10.3.2, < 11.4.9; >= 12.0.0, < 12.6.2; >= 13.0.0, < 13.1.1 |
Showing 14