31 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-118242
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Highcharts JS is a JavaScript charting library based on SVG. From 2.3.0 until 3.2.0, Highcharts Grid creates SVG path elements from rendering.icons object...
GHSA-6G3C-P4FG-XV47 Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`
Impact A custom icon supplied under rendering.icons as an icon definition object is built by creating an SVG path for each of its child entries and setting every key of that entry as an attribute of the path, without filtering the attribute names; only the string form of the option is passed...
Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`
Impact A custom icon supplied under rendering.icons as an icon definition object is built by creating an SVG path for each of its child entries and setting every key of that entry as an attribute of the path, without filtering the attribute names; only the string form of the option is passed...
Cross-site Scripting (XSS)
Overview @highcharts/grid-pro is a Highcharts Grid Pro framework Affected versions of this package are vulnerable to Cross-site Scripting XSS via the createSvgFromDefinition function in ts/Grid/Core/UI/SvgIcons.ts, where SVG path element attributes are set directly from user-supplied Grid icon...
Cross-site Scripting (XSS)
Overview @highcharts/grid-lite is a Highcharts Grid Lite framework Affected versions of this package are vulnerable to Cross-site Scripting XSS via the createSvgFromDefinition function in ts/Grid/Core/UI/SvgIcons.ts, where SVG path element attributes are set directly from user-supplied Grid icon...
CVE-2026-118242
Highcharts JS is a JavaScript charting library based on SVG. From 2.3.0 until 3.2.0, Highcharts Grid creates SVG path elements from rendering.icons object definitions and previously copied every child key with setAttribute. An attacker who controls Grid configuration can supply event-handler...
CVE-2026-118242 Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`
Highcharts JS is a JavaScript charting library based on SVG. From 2.3.0 until 3.2.0, Highcharts Grid creates SVG path elements from rendering.icons object definitions and previously copied every child key with setAttribute. An attacker who controls Grid configuration can supply event-handler...
CVE-2026-118242
The Highcharts JS charting library (versions 2.3.0 through 3.2.0 ) is vulnerable to Cross-Site Scripting (XSS) via the Highcharts Grid component. The root cause is the use of the raw setAttribute method to copy child keys from rendering.icons object definitions into SVG path elements. An attacker...
CVE-2026-118242
Highcharts JS is a JavaScript charting library based on SVG. From 2.3.0 until 3.2.0, Highcharts Grid creates SVG path elements from rendering.icons object definitions and previously copied every child key with setAttribute. An attacker who controls Grid configuration can supply event-handler...
EUVD-2026-112283
Highcharts JS is a JavaScript charting library based on SVG. From 2.3.0 until 3.2.0, Highcharts Grid creates SVG path elements from rendering.icons object definitions and previously copied every child key with setAttribute. An attacker who controls Grid configuration can supply event-handler...
PT-2026-129089
Highcharts JS is a JavaScript charting library based on SVG. From 2.3.0 until 3.2.0, Highcharts Grid creates SVG path elements from rendering.icons object definitions and previously copied every child key with setAttribute. An attacker who controls Grid configuration can supply event-handler...
CVE-2026-107378
The CairoSVG library, an SVG converter based on Cairo, is vulnerable to a Denial of Service (DoS) attack in versions prior to 2.9.1 . The root cause is an inefficient algorithmic complexity (CWE-407) within cairosvg/path.py, where the path tokenizer repeatedly slices and rescans path data. Additi...
CVE-2026-107378 CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>
CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while...
Linux Distros Unpatched Vulnerability : CVE-2026-79616
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path. CVE-2026-79616 Note that Nessus relies on the presence ...
SUSE CVE-2026-79616
Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path...
DEBIAN-CVE-2026-79616
Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path...
AZL-106830 CVE-2026-79616 affecting package qtdeclarative for versions less than 6.6.1-3
Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path...
CVE-2026-79616
Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path...
