Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype`

Impact The data cursor keeps its listener and state bookkeeping in plain objects keyed by data table id, so a table id of proto supplied in the dataPool connector configuration resolves to Object.prototype when a sync registers its listeners, and the registration creates a property on...

EUVD-2026-112302

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards stores DataCursor listener and state maps in plain objects keyed by DataTable ID. A proto table ID supplied through dataPool connector configuration resolves to Object.prototype, and sync...

CVE-2026-118243 Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype`

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards stores DataCursor listener and state maps in plain objects keyed by DataTable ID. A proto table ID supplied through dataPool connector configuration resolves to Object.prototype, and sync...

CVE-2026-118243

Highcharts Dashboards versions 1.0.0 through 4.2.2 are vulnerable to a Prototype Pollution vulnerability (CWE-1321). The root cause is that the library stores DataCursor listener and state maps in plain objects keyed by DataTable ID . If a __proto__ table ID is provided via the dataPool connector...

PT-2026-129090

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards stores DataCursor listener and state maps in plain objects keyed by DataTable ID. A proto table ID supplied through dataPool connector configuration resolves to Object.prototype, and sync...

EUVD-2025-29204

Malicious code in bioql PyPI...

CVE-2025-57248

A null pointer dereference vulnerability was discovered in SumatraPDF 3.5.2 during the processing of a crafted .djvu file. When the file is opened, the application crashes inside libmupdf.dll, specifically in the DataPool::hasdata function...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference in the hasdata function of DataPool during the processing of a specially crafted .djvu file. An attacker can cause the application to crash by tricking a user into opening a malicious file. Remediation A fix was...

CVE-2025-57248: NULL Pointer Dereference

A null pointer dereference vulnerability was discovered in SumatraPDF 3.5.2 during the processing of a crafted .djvu file. When the file is opened, the application crashes inside libmupdf.dll, specifically in the DataPool::hasdata function...

CVE-2025-57248

A null pointer dereference vulnerability was discovered in SumatraPDF 3.5.2 during the processing of a crafted .djvu file. When the file is opened, the application crashes inside libmupdf.dll, specifically in the DataPool::hasdata function...

CVE-2025-57248

A null pointer dereference vulnerability was discovered in SumatraPDF 3.5.2 during the processing of a crafted .djvu file. When the file is opened, the application crashes inside libmupdf.dll, specifically in the DataPool::hasdata function...

CVE-2025-57248

A null pointer dereference vulnerability was discovered in SumatraPDF 3.5.2 during the processing of a crafted .djvu file. When the file is opened, the application crashes inside libmupdf.dll, specifically in the DataPool::hasdata function...

CVE-2021-32492

A flaw was found in djvulibre-3.5.28 and earlier. An out of bounds read in function DJVU::DataPool::hasdata via crafted djvu file may lead to application crash and other consequences...

Denial Of Service (DoS)

djvulibre is vulnerable to denial of service. An out of bounds read in function DJVU::DataPool::hasdata via crafted djvu file may lead to application crash and other consequences...

CVE-2021-32492

A flaw was found in djvulibre-3.5.28 and earlier. An out of bounds read in function DJVU::DataPool::hasdata via crafted djvu file may lead to application crash and other consequences...

CVE-2021-32492

A flaw was found in djvulibre-3.5.28 and earlier. An out of bounds read in function DJVU::DataPool::hasdata via crafted djvu file may lead to application crash and other consequences...

CVE-2021-32492

A flaw was found in djvulibre-3.5.28 and earlier. An out of bounds read in function DJVU::DataPool::hasdata via crafted djvu file may lead to application crash and other consequences...

CVE-2021-32492: Improper Restriction of Operations within the Bounds of a Memory Buffer

A flaw was found in djvulibre-3.5.28 and earlier. An out of bounds read in function DJVU::DataPool::hasdata via crafted djvu file may lead to application crash and other consequences...

DjVuLibre DataPool Unauthorized Access

The vulnerability of DJVU::DataPool::hasdata in the set of libraries and utilities of DjVuLibre relates to reading beyond the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

UBUNTU-CVE-2021-32492

A flaw was found in djvulibre-3.5.28 and earlier. An out of bounds read in function DJVU::DataPool::hasdata via crafted djvu file may lead to application crash and other consequences...