https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 10:33:14 +0000 https://cve.radiocsirt.org/vuln/certfr-2022-avi-712 certfr-2022-avi-712 https://cve.radiocsirt.org/vuln/certfr-2022-avi-712 https://cve.radiocsirt.org/vuln/cnvd-2021-36222 cnvd-2021-36222 https://cve.radiocsirt.org/vuln/cnvd-2021-36222 https://cve.radiocsirt.org/vuln/euvd-2026-26407 EUVD-2026-26407 https://cve.radiocsirt.org/vuln/euvd-2026-26407 https://cve.radiocsirt.org/vuln/fkie_cve-2021-29489 <p>Highcharts JS is a JavaScript charting library based on SVG. In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted sources could execute code in the end user&#39;s browser. The vulnerability is patched in version 9. As a workaround, implementers who are not able to upgrade may apply DOMPurify recursively to the options structure to filter out malicious markup.</p> <p>Highcharts JS is a JavaScript charting library based on SVG. In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted sources could execute code in the end user&#39;s browser. The vulnerability is patched in version 9. As a workaround, implementers who are not able to upgrade may apply DOMPurify recursively to the options structure to filter out malicious markup.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-29489 https://cve.radiocsirt.org/vuln/ghsa-8j65-4pcq-xq95 <p><strong>Affected:</strong> npm: highcharts</p> <p>### Impact In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted sources could execute code in the end user&#39;s browser. Especially when using the `useHTML` flag, HTML string options would be inserted unfiltered directly into the DOM. When `useHTML` was false, malicious code could be inserted by using various character replacement tricks or malformed HTML.</p> <p>If your chart configuration comes from a trusted source like a static setup or pre-filtered HTML (or no markup at all in the configuration), you are not impacted.</p> <p>### Patches In version 9, the whole rendering layer was refactored to use an DOMParser, an AST and tag and HTML allow-listing to make sure only safe content entered the DOM. In addition, prototype pollution was stopped.</p> <p>### Workarounds Implementers who are not able to upgrade may apply [DOMPurify](https://github.com/cure53/DOMPurify) recursively [to the options structure](https://jsfiddle.net/highcharts/zd3wcm5L/) to filter out malicious markup.</p> <p>### References * Details on the improved [Highcharts security](https://www.highcharts.com/docs/chart-concepts/security) * [The AST and TextBuilder refactoring](https://github.com/highcharts/highcharts/pull/14913) * [The fix for prototype pollution](https://github.com/highcharts/highcharts/pull/14884)</p> <p>### For more information If you have any questions or comments about this advisory: * Visit our [support pag…</p> <p><strong>Affected:</strong> npm: highcharts</p> <p>### Impact In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted sources could execute code in the end user&#39;s browser. Especially when using the `useHTML` flag, HTML string options would be inserted unfiltered directly into the DOM. When `useHTML` was false, malicious code could be inserted by using various character replacement tricks or malformed HTML.</p> <p>If your chart configuration comes from a trusted source like a static setup or pre-filtered HTML (or no markup at all in the configuration), you are not impacted.</p> <p>### Patches In version 9, the whole rendering layer was refactored to use an DOMParser, an AST and tag and HTML allow-listing to make sure only safe content entered the DOM. In addition, prototype pollution was stopped.</p> <p>### Workarounds Implementers who are not able to upgrade may apply [DOMPurify](https://github.com/cure53/DOMPurify) recursively [to the options structure](https://jsfiddle.net/highcharts/zd3wcm5L/) to filter out malicious markup.</p> <p>### References * Details on the improved [Highcharts security](https://www.highcharts.com/docs/chart-concepts/security) * [The AST and TextBuilder refactoring](https://github.com/highcharts/highcharts/pull/14913) * [The fix for prototype pollution](https://github.com/highcharts/highcharts/pull/14884)</p> <p>### For more information If you have any questions or comments about this advisory: * Visit our [support pag…</p> https://cve.radiocsirt.org/vuln/ghsa-8j65-4pcq-xq95 https://cve.radiocsirt.org/vuln/gsd-2021-29489 gsd-2021-29489 https://cve.radiocsirt.org/vuln/gsd-2021-29489 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1643 <p>Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.</p> <p>Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1643