CVE-2026-124691

In Progress Kendo UI for jQuery Gantt, the task editor's Parent dropdown renders task titles as HTML. An attacker who can influence a task title shown in the dropdown can cause attacker-controlled markup to execute as JavaScript when a user opens or interacts with the task editor. Successful...

CVE-2026-124691 Cross-Site Scripting in Kendo UI for jQuery Gantt Parent Dropdown

In Progress Kendo UI for jQuery Gantt, the task editor's Parent dropdown renders task titles as HTML. An attacker who can influence a task title shown in the dropdown can cause attacker-controlled markup to execute as JavaScript when a user opens or interacts with the task editor. Successful...

CVE-2022-0540-RCE

Atlassian Jira Seraph Authentication Bypass RCE（CVE-2022-0540） English • 中文 Exploit Details As seen in author's blog, atlassian provided a long list of affected plugins the vast majority of which were false positives, and the author listed several actual affected plugins According to the prompted...

CVE-2026-106127

Prototype Pollution in the setter utility @progress/kendo-react-common in Progress Software KendoReact versions 3.5.0 through 16.0.0 allows a high-privileged attacker who can control a field path passed to the utility, directly or through components such as the Form, Scheduler, and Gantt, to modi...

CVE-2026-106127 Prototype Pollution in Progress Software KendoReact

Prototype Pollution in the setter utility @progress/kendo-react-common in Progress Software KendoReact versions 3.5.0 through 16.0.0 allows a high-privileged attacker who can control a field path passed to the utility, directly or through components such as the Form, Scheduler, and Gantt, to modi...

CVE-2026-106127

Progress Software KendoReact versions 3.5.0 through 16.0.0 are vulnerable to a Prototype Pollution flaw within the setter utility (@progress/kendo-react-common). A high-privileged attacker capable of controlling a field path—either directly or through components like Form , Scheduler , and Gantt ...

EUVD-2026-118370

Prototype Pollution in the setter utility @progress/kendo-react-common in Progress Software KendoReact versions 3.5.0 through 16.0.0 allows a high-privileged attacker who can control a field path passed to the utility, directly or through components such as the Form, Scheduler, and Gantt, to modi...

PT-2026-138128

Prototype Pollution in the setter utility @progress/kendo-react-common in Progress Software KendoReact versions 3.5.0 through 16.0.0 allows a high-privileged attacker who can control a field path passed to the utility, directly or through components such as the Form, Scheduler, and Gantt, to modi...

Linux Distros Unpatched Vulnerability : CVE-2026-118251

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Highcharts JS is a JavaScript charting library based on SVG. Prior to 11.4.9, 12.6.1, and 13.1.0, Highcharts assigns credits.href to the window location when th...

GHSA-5793-X2Q3-C3Q7 Highcharts: `javascript:` URL in credits.href runs script on click

Impact A credits.href value beginning with javascript: is assigned to the window location when the credits label is clicked, without being checked against an allowed-scheme list. An attacker who controls the chart configuration can therefore run script in the origin of the page hosting the chart...

Highcharts: `javascript:` URL in credits.href runs script on click

Impact A credits.href value beginning with javascript: is assigned to the window location when the credits label is clicked, without being checked against an allowed-scheme list. An attacker who controls the chart configuration can therefore run script in the origin of the page hosting the chart...

Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes

Impact The breadcrumbs style option is applied to the breadcrumb button as SVG attributes rather than as CSS, and the attribute names are not filtered. An attacker who controls the chart configuration can supply keys under breadcrumbs.style that name event handlers, and those keys become live...

CVE-2026-118251

Highcharts JS is a JavaScript charting library based on SVG. Prior to 11.4.9, 12.6.1, and 13.1.0, Highcharts assigns credits.href to the window location when the credits label is clicked without checking the URL against the allowed-scheme list. An attacker who controls chart configuration can...

CVE-2026-118244

Highcharts JS is a JavaScript charting library based on SVG. From 12.0.0 until 12.6.1 and 13.1.0, Highcharts falls back to assigning raw markup to innerHTML when DOMParser cannot return a document, before its allow-list is applied. In Chromium, the Trusted Types callback can throw while a...

CVE-2026-118251 Highcharts: javascript: URL in credits.href runs script on click

Highcharts JS is a JavaScript charting library based on SVG. Prior to 11.4.9, 12.6.1, and 13.1.0, Highcharts assigns credits.href to the window location when the credits label is clicked without checking the URL against the allowed-scheme list. An attacker who controls chart configuration can...

CVE-2026-118251

Highcharts JS is a JavaScript charting library based on SVG. Prior to 11.4.9, 12.6.1, and 13.1.0, Highcharts assigns credits.href to the window location when the credits label is clicked without checking the URL against the allowed-scheme list. An attacker who controls chart configuration can...

EUVD-2026-112365

Highcharts JS is a JavaScript charting library based on SVG. Prior to 11.4.9, 12.6.1, and 13.1.0, Highcharts assigns credits.href to the window location when the credits label is clicked without checking the URL against the allowed-scheme list. An attacker who controls chart configuration can...

CVE-2026-118251 Highcharts: javascript: URL in credits.href runs script on click

Highcharts JS is a JavaScript charting library based on SVG. Prior to 11.4.9, 12.6.1, and 13.1.0, Highcharts assigns credits.href to the window location when the credits label is clicked without checking the URL against the allowed-scheme list. An attacker who controls chart configuration can...

CVE-2026-118251

The Highcharts JS charting library (and its associated components Highcharts Stock , Maps , and Gantt ) is vulnerable to a Cross-Site Scripting (XSS) flaw in versions prior to 11.4.9 , 12.6.1 , and 13.1.0 . The root cause is the library's failure to validate the credits.href URL against an allowe...

CVE-2026-118251 Highcharts: javascript: URL in credits.href runs script on click

Highcharts JS is a JavaScript charting library based on SVG. Prior to 11.4.9, 12.6.1, and 13.1.0, Highcharts assigns credits.href to the window location when the credits label is clicked without checking the URL against the allowed-scheme list. An attacker who controls chart configuration can...