Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
21 results
Oct 28, 2026Highcharts JS is a JavaScript charting library based on SVG.CVE-2026-118255 · Other software · highcharts · reported by GitHubHigh 8.4
Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid applies credits.href to the credits link without validating the URL scheme. An attacker who controls Grid configuration can provide a javascript URL, and activating the credits link runs script in the origin of the hosting page with access to that application's data and session state.This issue is fixed in Grid Pro 3.2.0.
- Product
- highcharts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026Highcharts JS is a JavaScript charting library based on SVG.CVE-2026-118254 · Other software · highcharts · reported by GitHubHigh 8.6
Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid writes pagination language strings into the DOM as markup instead of text. An attacker who controls the Grid language configuration can provide elements with event handlers, which execute in the hosting page origin when pagination controls render. Exploitation requires pagination to be enabled but does not require additional user interaction. This issue is fixed in 3.2.0.
- Product
- highcharts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026Highcharts JS is a JavaScript charting library based on SVG.CVE-2026-118253 · Other software · highcharts · reported by GitHubHigh 8.4
Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit mode parses fullscreen language labels as HTML rather than inserting them as text. An attacker who controls Dashboards language options can supply markup with event handlers, which execute in the hosting page origin when the fullscreen control is rendered. The label is reachable only when edit mode is enabled and viewFullscreen is present in the context-menu items. This issue is fixed in 4.2.3.
- Product
- highcharts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026Highcharts JS is a JavaScript charting library based on SVG.CVE-2026-118252 · Other software · highcharts · reported by GitHubHigh 8.4
Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit-mode sidebar parses component language strings as HTML rather than inserting them as text. An attacker who controls the Dashboards language configuration can provide markup containing event handlers, which execute in the hosting page origin when a user opens the edit-mode sidebar and the affected labels render. This issue is fixed in 4.2.3.
- Product
- highcharts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026Highcharts JS is a JavaScript charting library based on SVG.CVE-2026-118251 · Other software · highcharts · reported by GitHubHigh 8.4
Highcharts JS is a JavaScript charting library based on SVG. Prior to 11.4.9, 12.6.1, and 13.1.0, Highcharts assigns credits.href to the window location when the credits label is clicked without checking the URL against the allowed-scheme list. An attacker who controls chart configuration can provide a javascript URL and run script in the origin of the hosting page when a user clicks the credits label. Highcharts Stock, Maps, and Gantt are included because they ship from the same package. This issue is fixed in 11.4.9, 12.6.1 and 13.1.0.
- Product
- highcharts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026Highcharts JS is a JavaScript charting library based on SVG.CVE-2026-118250 · Other software · highcharts · reported by GitHubHigh 7.2
Highcharts JS is a JavaScript charting library based on SVG. From 6.1.0 until 11.4.9, 12.6.1, and 3.1.0, Highcharts follows dot-separated series.keys paths without filtering each segment. An attacker who controls series.keys and matching point data can use a path through __proto__ to assign arbitrary named properties to Object.prototype. Those properties are visible to all JavaScript in the page, and no user interaction is required beyond rendering the chart. This issue is fixed in 11.4.9, 12.6.1, and 3.1.0.
- Product
- highcharts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026Highcharts JS is a JavaScript charting library based on SVG.CVE-2026-118249 · Other software · highcharts · reported by GitHubHigh 7.2
Highcharts JS is a JavaScript charting library based on SVG. From 13.0.0 until 13.1.0, Highcharts builds series data columns by using point option keys directly as column IDs. Own enumerable __proto__ and constructor keys from parsed point objects can therefore direct integer-indexed writes to Object.prototype or the Object constructor. The inherited values affect reads and for-in enumeration across the page and can disrupt rendering or alter consuming application behavior without user interaction beyond rendering the chart. This issue is fixed in 13.1.0.
- Product
- highcharts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026Highcharts JS is a JavaScript charting library based on SVG.CVE-2026-118248 · Other software · highcharts · reported by GitHubMedium 6.9
Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards edit mode walks editableOptions propertyPath segments without rejecting prototype-related keys. An attacker who controls editableOptions can provide a path through __proto__ or constructor, and a user's edit writes the configured value onto Object.prototype. The property then becomes visible to JavaScript throughout the page, with consequences determined by the consuming application. This issue is fixed in 4.2.2.
- Product
- highcharts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026Highcharts JS is a JavaScript charting library based on SVG.CVE-2026-118247 · Other software · highcharts · reported by GitHubMedium 6.9
Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until Dashboards 4.2.2, and from 2.0.0 until Grid Pro 3.2.0, Highcharts DataTable single-cell writers use an untrusted column ID as a key without rejecting __proto__ or constructor. DataTable.setCell, including Dashboards connector write-back and Grid Pro editing paths, can therefore write integer-indexed values onto Object.prototype or the Object constructor. In Dashboards releases with column aliases, a literal __proto__ ID is redirected by the alias map, while an alias targeting __proto__ reaches the unsafe write; later releases without aliases accept the unsafe ID directly. Those inherited values affect array and object reads and for-in enumeration throughout the page, which can alter application control flow or disrupt rendering. Exploitation requires control of the table or component column ID and a cell, point, or API write. This issue is fixed in Dashboards 4.2.2 and Grid Pro 3.2.0.
- Product
- highcharts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026Highcharts JS is a JavaScript charting library based on SVG.CVE-2026-118246 · Other software · highcharts · reported by GitHubHigh 8.4
Highcharts JS is a JavaScript charting library based on SVG. From 10.0.0 until 11.4.9, 12.6.1, and 13.1.0, Highcharts applies breadcrumbs.style as SVG attributes rather than CSS and does not filter the attribute names. An attacker who controls chart configuration can provide event-handler keys through drilldown.breadcrumbs, navigation.breadcrumbs, or hierarchical series breadcrumb options. The keys become active handlers on the breadcrumb button and execute in the hosting page origin after the user navigates to a level and hovers over or activates the button. Styled-mode charts do not apply this option and are not affected. This issue is fixed in 11.4.9, 12.6.1 and 13.1.0.
- Product
- highcharts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026Highcharts JS is a JavaScript charting library based on SVG.CVE-2026-118245 · Other software · highcharts · reported by GitHubHigh 8.6
Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards uses chartConstructor as an unchecked property lookup in the Highcharts namespace and invokes the selected member with the component container and chartOptions. An attacker who controls dashboard configuration can select a public utility function instead of a supported chart constructor, causing attacker-controlled options to be copied to the container as properties or attributes. Markup and event handlers can then execute in the hosting page origin when the board renders. No user interaction beyond rendering the board is required. This issue is fixed in 4.2.2.
- Product
- highcharts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026Highcharts JS is a JavaScript charting library based on SVG.CVE-2026-118244 · Other software · highcharts · reported by GitHubHigh 7.2
Highcharts JS is a JavaScript charting library based on SVG. From 12.0.0 until 12.6.1 and 13.1.0, Highcharts falls back to assigning raw markup to innerHTML when DOMParser cannot return a document, before its allow-list is applied. In Chromium, the Trusted Types callback can throw while a beforeprint handler runs, so a page that redraws a chart during beforeprint can insert untrusted HTML text options into the hosting document. Event handlers in that markup then run in the page origin when printing begins. The issue affects HTML-rendered titles, labels, data labels, responsive text, and the Stock, Maps, and Gantt products shipped in the same package. This issue is fixed in 12.6.1 and 13.1.0.
- Product
- highcharts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026Highcharts JS is a JavaScript charting library based on SVG.CVE-2026-118243 · Other software · highcharts · reported by GitHubMedium 5.3
Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards stores DataCursor listener and state maps in plain objects keyed by DataTable ID. A __proto__ table ID supplied through dataPool connector configuration resolves to Object.prototype, and sync registration creates an enumerable property there whose suffix can be influenced through the sync group option. The property is visible on every object, and lasting sync states can throw and stop features such as extremes synchronization. Exploitation requires untrusted dashboard configuration and an enabled component sync, but no user interaction beyond loading the board. This issue is fixed in 4.2.2.
- Product
- highcharts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026Highcharts JS is a JavaScript charting library based on SVG.CVE-2026-118242 · Other software · highcharts · reported by GitHubHigh 8.5
Highcharts JS is a JavaScript charting library based on SVG. From 2.3.0 until 3.2.0, Highcharts Grid creates SVG path elements from rendering.icons object definitions and previously copied every child key with setAttribute. An attacker who controls Grid configuration can supply event-handler attribute names in an icon definition. Because custom icons override built-ins, the attacker can replace default sort or pagination icons, and script runs in the hosting page origin when a user hovers over or activates the affected icon. This issue is fixed in 3.2.0.
- Product
- highcharts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026Highcharts JS is a JavaScript charting library based on SVG.CVE-2026-116797 · Other software · highcharts · reported by GitHubHigh 8.5
Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid Pro input renderers copy the cells.renderer.attributes and cells.editMode.renderer.attributes maps to input or select elements with raw setAttribute calls. An attacker who controls column configuration can add event-handler attributes to every rendered row or to the control created when a cell enters edit mode. Script then runs in the hosting page origin when a user hovers over or focuses an input or begins editing. This issue is fixed in Grid Pro 3.2.0.
- Product
- highcharts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026Highcharts JS is a JavaScript charting library based on SVG.CVE-2026-116796 · Other software · highcharts · reported by GitHubHigh 7.2
Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker who controls a chart text option can preserve a javascript URL in serialized chart output. When exported or server-rendered SVG is parsed again and a user activates the link, script runs in the origin of that document. This issue is fixed in 11.4.9, 12.6.2 and 13.1.1.
- Product
- highcharts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026Vaadin Charts renders charts with the Highcharts library and pins an exact version of it, 9.2.2 in Vaadin 22 to 24 and 12.2.0 in Vaadin 25, so an application caCVE-2026-107588 · Other software · vaadin · reported by security@vaadin.comHigh 8.4
Vaadin Charts renders charts with the Highcharts library and pins an exact version of it, 9.2.2 in Vaadin 22 to 24 and 12.2.0 in Vaadin 25, so an application cannot remove these vulnerabilities by upgrading Highcharts on its own. Highsoft disclosed several vulnerabilities in that library that are reachable through the chart configuration: writes to Object.prototype through dotted series.keys paths, and cross-site scripting through credits.href, through breadcrumbs.style, through HTML text parsing while printing, and through xlink:href attributes in exported charts. An application is affected where data an attacker controls reaches the chart configuration, for example through additionalOptions, through updateConfiguration(), or through text options that accept markup. The fixed Vaadin versions apply Highsoft's recommended workarounds to the bundled Highcharts when it loads, and keep the same Highcharts version. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin 22.0.0 - 23.6.15 Vaadin 24.0.0 - 24.4.23 Vaadin 24.5.0 - 24.7.15 Vaadin 24.8.0 - 24.9.22 Vaadin 24.10.0 - 24.10.10 Vaadin 25.0.0
- Product
- vaadin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025Nagios XI versions prior to 5.8.7 used a temporary directory for Highcharts exports with overly permissive ownership/permissions under the Apache user.CVE-2021-47700 · Other software · Nagios · reported by VulnCheckHigh 8.5
Nagios XI versions prior to 5.8.7 used a temporary directory for Highcharts exports with overly permissive ownership/permissions under the Apache user. Local or co-hosted processes could read/overwrite export artifacts or manipulate paths, risking disclosure or tampering and potential code execution depending on deployment.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnagios.comvulncheck.com
Oct 30, 2025Nagios XI versions prior to 5.6.11 contain unauthenticated vulnerabilities in the Highcharts local exporting tool.CVE-2020-36862 · Other software · Nagios · reported by VulnCheckMedium 6.9
Nagios XI versions prior to 5.6.11 contain unauthenticated vulnerabilities in the Highcharts local exporting tool. Crafted export requests could (1) inject script into exported/returned content due to insufficient output encoding (XSS), and (2) cause the server to fetch attacker-specified URLs (SSRF), potentially accessing internal network resources. An unauthenticated remote attacker can leverage these issues to execute script in a user's browser when the exported content is viewed and to disclose sensitive information reachable from the export server via SSRF.
- Product
- XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnagios.comvulncheck.com
May 5, 2021Highcharts JS is a JavaScript charting library based on SVG.CVE-2021-29489 · Other software · highcharts · reported by GitHubHigh 7.6
Highcharts JS is a JavaScript charting library based on SVG. In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted sources could execute code in the end user's browser. The vulnerability is patched in version 9. As a workaround, implementers who are not able to upgrade may apply DOMPurify recursively to the options structure to filter out malicious markup.
- Product
- highcharts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.netapp.com
Mar 14, 2019In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a denial of service attacCVE-2018-20801 · Other software · Highcharts · reported by MITREHigh 7.5
In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a denial of service attack against the SVGRenderer component, aka ReDoS.
- Product
- Highcharts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.netapp.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.