CVE-2024-42009

CVE-2024-42009 – Roundcube Stored XSS Docker PoC 📌 Overview This repository demonstrates a working Proof-of-Concept PoC for CVE-2024-42009 , a stored Cross-Site Scripting XSS vulnerability in Roundcube Webmail. The vulnerability is caused by improper HTML sanitization followed by unsafe attribute...

CVE-2026-116797

A flaw was found in Highcharts Grid Pro. Cross-Site Scripting XSS can occur when an attacker who controls table column configurations injects malicious event-handler attributes into rendered input elements. When a user interacts with or edits an affected cell, the injected script executes in thei...

Cross-site Scripting (XSS)

Overview highcharts is a JavaScript charting library based on SVG, with fallbacks to VML and canvas for old browsers. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the breadcrumbs.style option, which is passed to SVGElement.attr rather than applied as CSS. An...

GHSA-35RR-XWFH-X789 Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes

Impact The breadcrumbs style option is applied to the breadcrumb button as SVG attributes rather than as CSS, and the attribute names are not filtered. An attacker who controls the chart configuration can supply keys under breadcrumbs.style that name event handlers, and those keys become live...

npm: Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes

npm: Highcharts Core: breadcrumbs.style keys become SVG event-handler attributes vulnerability discovered by ? in WordPress npm highcharts versions = 10.0.0, 11.4.9...

CVE-2026-99166

In the Linux kernel, the following vulnerability has been resolved: net: rds: fix uninitialized trans dereference in CM event handler rdsrdmacmeventhandlercmn assigns trans only when the RDMA device is an InfiniBand CA RDMANODEIBCA. On any other device type, e.g. an iWARP RNIC such as siw, trans...

CVE-2026-118246

Highcharts JS is a JavaScript charting library based on SVG. From 10.0.0 until 11.4.9, 12.6.1, and 13.1.0, Highcharts applies breadcrumbs.style as SVG attributes rather than CSS and does not filter the attribute names. An attacker who controls chart configuration can provide event-handler keys...

CVE-2026-116797

Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid Pro input renderers copy the cells.renderer.attributes and cells.editMode.renderer.attributes maps to input or select elements with raw setAttribute calls. An attacker who controls column...

CVE-2026-118246 Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes

Highcharts JS is a JavaScript charting library based on SVG. From 10.0.0 until 11.4.9, 12.6.1, and 13.1.0, Highcharts applies breadcrumbs.style as SVG attributes rather than CSS and does not filter the attribute names. An attacker who controls chart configuration can provide event-handler keys...

CVE-2026-118246 Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes

Highcharts JS is a JavaScript charting library based on SVG. From 10.0.0 until 11.4.9, 12.6.1, and 13.1.0, Highcharts applies breadcrumbs.style as SVG attributes rather than CSS and does not filter the attribute names. An attacker who controls chart configuration can provide event-handler keys...

CVE-2026-118246

Highcharts JS is a JavaScript charting library based on SVG. From 10.0.0 until 11.4.9, 12.6.1, and 13.1.0, Highcharts applies breadcrumbs.style as SVG attributes rather than CSS and does not filter the attribute names. An attacker who controls chart configuration can provide event-handler keys...

CVE-2026-118246

The Highcharts JS library (versions 10.0.0 through 11.4.9 , 12.6.1 , and 13.1.0 ) is vulnerable to a Cross-Site Scripting (XSS) flaw because it applies breadcrumbs.style as SVG attributes without filtering attribute names. An attacker who can control the chart configuration can inject event-handl...

EUVD-2026-112283

Highcharts JS is a JavaScript charting library based on SVG. From 2.3.0 until 3.2.0, Highcharts Grid creates SVG path elements from rendering.icons object definitions and previously copied every child key with setAttribute. An attacker who controls Grid configuration can supply event-handler...

EUVD-2026-112281

Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid Pro input renderers copy the cells.renderer.attributes and cells.editMode.renderer.attributes maps to input or select elements with raw setAttribute calls. An attacker who controls column...

CVE-2026-99166 net: rds: fix uninitialized trans dereference in CM event handler

In the Linux kernel, the following vulnerability has been resolved: net: rds: fix uninitialized trans dereference in CM event handler rdsrdmacmeventhandlercmn assigns trans only when the RDMA device is an InfiniBand CA RDMANODEIBCA. On any other device type, e.g. an iWARP RNIC such as siw, trans...

CVE-2026-99166

The Linux kernel contains a vulnerability in the RDS (RDMA Sports) protocol where an uninitialized trans pointer in the rds_rdma_cm_event_handler_cmn() function causes a kernel crash. The issue occurs because trans is only assigned when the RDMA device is an InfiniBand CA ; on other devices like ...

CVE-2026-99166 net: rds: fix uninitialized trans dereference in CM event handler

In the Linux kernel, the following vulnerability has been resolved: net: rds: fix uninitialized trans dereference in CM event handler rdsrdmacmeventhandlercmn assigns trans only when the RDMA device is an InfiniBand CA RDMANODEIBCA. On any other device type, e.g. an iWARP RNIC such as siw, trans...

PT-2026-128159

In the Linux kernel, the following vulnerability has been resolved: net: rds: fix uninitialized trans dereference in CM event handler rds rdma cm event handler cmn assigns trans only when the RDMA device is an InfiniBand CA RDMA NODE IB CA. On any other device type, e.g. an iWARP RNIC such as siw...

CVE-2026-99166: Linux: In the Linux kernel, the following vulnerability has been resolved: net: rds: fix uninitialized trans dereference in CM…

In the Linux kernel, the following vulnerability has been resolved: net: rds: fix uninitialized trans dereference in CM event handler rdsrdmacmeventhandlercmn assigns trans only when the RDMA device is an InfiniBand CA RDMANODEIBCA. On any other device type, e.g. an iWARP RNIC such as siw, trans...

CVE-2026-116797: Improper Neutralization of Input During Web Page Generation

Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid Pro input renderers copy the cells.renderer.attributes and cells.editMode.renderer.attributes maps to input or select elements with raw setAttribute calls. An attacker who controls column...