Patchfirst
Patchfirst
Chainhighchartsnpm:highcharts

highcharts: related fixes (2026)

7 CVEs over 3 generations, 21 Oct 2026 to 28 Oct 2026.

Family tree

Left to right by publication date.Oldest first. Select a CVE to open it.
  1. CVE-2026-10758821 Oct 2026 First in the chain
  2. CVE-2026-11679628 Oct 2026 related to CVE-2026-107588
  3. CVE-2026-11824428 Oct 2026 related to CVE-2026-107588related to CVE-2026-116796
  4. CVE-2026-11824628 Oct 2026 related to CVE-2026-107588
  5. CVE-2026-11824928 Oct 2026 related to CVE-2026-107588
  6. CVE-2026-11825028 Oct 2026 related to CVE-2026-107588related to CVE-2026-118249
  7. CVE-2026-11825128 Oct 2026 related to CVE-2026-107588
21 Oct 202624 Oct28 Oct CVE-2026-107588 → CVE-2026-116796: related (high confidence)CVE-2026-107588 → CVE-2026-118244: related (high confidence)CVE-2026-107588 → CVE-2026-118246: related (high confidence)CVE-2026-107588 → CVE-2026-118249: related (high confidence)CVE-2026-107588 → CVE-2026-118250: related (high confidence)CVE-2026-107588 → CVE-2026-118251: related (high confidence)CVE-2026-116796 → CVE-2026-118244: related (medium confidence)CVE-2026-118249 → CVE-2026-118250: related (medium confidence) CVE-2026-107588 21 Oct 2026 CVE-2026-116796 28 Oct 2026 CVE-2026-118244 28 Oct 2026 CVE-2026-118246 28 Oct 2026 CVE-2026-118249 28 Oct 2026 CVE-2026-118250 28 Oct 2026 CVE-2026-118251 28 Oct 2026 21 Oct 202624 Oct28 Oct CVE-2026-107588 → CVE-2026-116796: related (high confidence)CVE-2026-107588 → CVE-2026-118244: related (high confidence)CVE-2026-107588 → CVE-2026-118246: related (high confidence)CVE-2026-107588 → CVE-2026-118249: related (high confidence)CVE-2026-107588 → CVE-2026-118250: related (high confidence)CVE-2026-107588 → CVE-2026-118251: related (high confidence)CVE-2026-116796 → CVE-2026-118244: related (medium confidence)CVE-2026-118249 → CVE-2026-118250: related (medium confidence) CVE-2026-107588 21 Oct 2026 CVE-2026-116796 28 Oct 2026 CVE-2026-118244 28 Oct 2026 CVE-2026-118246 28 Oct 2026 CVE-2026-118249 28 Oct 2026 CVE-2026-118250 28 Oct 2026 CVE-2026-118251 28 Oct 2026
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low

CVEs in this family

Table view of the tree
CVEPublishedTitleLinked fromPriority
CVE-2026-107588 21 Oct 2026 Multiple Vulnerabilities in the Highcharts Library Bundled with Vaadin Charts First in chain 14.8
CVE-2026-116796 28 Oct 2026 Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts CVE-2026-107588 · related · High 10.5
CVE-2026-118244 28 Oct 2026 Highcharts Core: AST `DOMParser` fallback assigns unsanitized markup to `innerHTML` during print CVE-2026-107588 · related · High 10.5
CVE-2026-118246 28 Oct 2026 Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes CVE-2026-107588 · related · High 11.3
CVE-2026-118249 28 Oct 2026 Highcharts: series column construction writes to Object.prototype CVE-2026-107588 · related · High 11.1
CVE-2026-118250 28 Oct 2026 Highcharts: dotted series.keys paths write to Object.prototype CVE-2026-107588 · related · High 11.1
CVE-2026-118251 28 Oct 2026 Highcharts: javascript: URL in credits.href runs script on click CVE-2026-107588 · related · High 13.4
↑ ↓ chooseEnter openEsc close