CVE-2026-107588
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
Vaadin Charts renders charts with the Highcharts library and pins an exact version (9.2.2 in Vaadin 22-24 and 12.2.0 in Vaadin 25), so an application cannot remove these vulnerabilities by upgrading Highcharts on its own. Highsoft disclosed several vulnerabilities reachable through the chart configuration: writes to Object.prototype through dotted series.keys paths, and cross-site scripting through credits.href, breadcrumbs.style, HTML text parsing while printing, and xlink:href attributes in exported charts. An application is affected where attacker-controlled data reaches the chart configuration, for example through additionalOptions, updateConfiguration(), or text options that accept markup.
Risk Assessment
An attacker may achieve script execution in the user's browser (XSS) or manipulate object prototypes in the application context if input data reaches the chart configuration. This can lead to session theft, actions performed on behalf of the user, or further escalation within the application.
Recommendation
Upgrade Vaadin to a fixed version (e.g. 23.6.16, 24.4.24, 24.7.16, 24.9.23, 24.10.11, 25.2.10, or 25.3.1 and newer) — the fix applies Highsoft's recommended workarounds to the bundled Highcharts at load time. Do not rely on upgrading Highcharts independently, as Vaadin pins a specific library version.
Related vulnerabilities
- CVE-2026-121933Critical
A flaw has been found in Linksys E5350 1.0.00.037. This impacts the function save_settings of the file /wizard/apply.cgi of the Setup Wizard component. Manipulating the wizard_router_pwd argument can lead to missing authentication. The attack may be launched remotely, and the exploit has been published and may be used.
- CVE-2026-113373Critical
Sonatype Nexus Repository 3 Pro does not check the local account status when a user signs in through a configured SAML or OAuth2/OpenID Connect identity provider. A user whose account was disabled or locked by an administrator in Nexus Repository can sign in again with valid identity provider credentials for the same account and then receives a new session with the roles of that account.
- CVE-2026-122120Critical
In Yealink Plug-in Softwares before 2.35.219.0, an unauthorized file write vulnerability exists under specific scenarios. It may be exploited by attackers to achieve remote code execution.
- CVE-2026-121932Critical
In Linksys E5350 1.0.00.037, the system function in /wizard/apply.cgi mishandles the ping_ip/traceroute_ip argument, resulting in OS command injection. The attack can be launched remotely and the exploit is publicly available.
- CVE-2026-121931Critical
In Linksys WRT54GL 4.30.18, the system function in apply.cgi (Traceroute Diagnostic component) mishandles the traceroute_ip argument, enabling OS command injection. The attack can be launched remotely and the exploit has been publicly disclosed.
- CVE-2026-121930Critical
In Linksys WRT54GL 4.30.18, the system function in apply.cgi (Ping Diagnostic component) mishandles the ping_ip argument, causing OS command injection. The attack can be initiated remotely and the exploit has been made public.
- CVE-2026-113780Critical
In ESP-IDF (Espressif IoT Development Framework) from 5.5.5 until 5.5.6, 6.0.4, and 6.1.1, the esp_tee trap entry saves a caller-controlled register frame through the REE-supplied stack pointer before switching to the trusted TEE stack or validating the pointer. A local unprivileged REE application can direct this machine-mode write into TEE-exclusive memory on ESP32-C5, ESP32-C6, ESP32-C61, and ESP32-H2 devices, breaking the REE/TEE isolation boundary.
- CVE-2026-107846Critical
In bitcoinjs-lib (JavaScript Bitcoin library for Node.js and browsers) from 2.3.0 until 5.2.1, 6.1.8, and 7.0.2, fastMerkleRoot pads odd Merkle-tree levels by hashing the final node with itself but does not report adjacent duplicate hashes. Validation paths can accept a recomputed root without checking for mutation, allowing a peer to append duplicate transactions while retaining the original Merkle root, block header, and proof of work.
- CVE-2026-121953Critical
FreeRDP before 3.32.2 has a use-after-free in the client's rdpgfx dynamic virtual channel: a duplicate-name channel with a new ChannelId overwrites the listener's single callback slot, which rdpgfx_on_close frees without clearing. A malicious RDP server can open and close such a channel, then send a PDU on the original channel to crash the client or potentially execute code.
- CVE-2026-121952Critical
FreeRDP before 3.32.2 has an out-of-bounds write in the proxy because rdp_read_bitmap_cache_v2_capability_set rejects only numCellCaches values above 5, yet the bitmap cache v2 cell array is later accessed at fixed indices 0 through 4. A client connecting to the proxy can declare fewer than five cell caches in its Confirm Active, causing heap corruption, heap data leakage to the backend, or a crash.
Original NVD description (English source)
Vaadin Charts renders charts with the Highcharts library and pins an exact version of it, 9.2.2 in Vaadin 22 to 24 and 12.2.0 in Vaadin 25, so an application cannot remove these vulnerabilities by upgrading Highcharts on its own. Highsoft disclosed several vulnerabilities in that library that are reachable through the chart configuration: writes to Object.prototype through dotted series.keys paths, and cross-site scripting through credits.href, through breadcrumbs.style, through HTML text parsing while printing, and through xlink:href attributes in exported charts. An application is affected where data an attacker controls reaches the chart configuration, for example through additionalOptions, through updateConfiguration(), or through text options that accept markup. The fixed Vaadin versions apply Highsoft's recommended workarounds to the bundled Highcharts when it loads, and keep the same Highcharts version. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin 22.0.0 - 23.6.15 Vaadin 24.0.0 - 24.4.23 Vaadin 24.5.0 - 24.7.15 Vaadin 24.8.0 - 24.9.22 Vaadin 24.10.0 - 24.10.10 Vaadin 25.0.0 - 25.2.9 Vaadin 25.3.0 Mitigation Upgrade to 23.6.16 Upgrade to 24.4.24 Upgrade to 24.7.16 Upgrade to 24.9.23 Upgrade to 24.10.11 Upgrade to 25.2.10 Upgrade to 25.3.1 or newer Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version. Artifacts Maven coordinates / Vulnerable versions / Fixed version com.vaadin:vaadin / 22.0.0 - 23.6.15 / >=23.6.16 com.vaadin:vaadin / 24.0.0 - 24.4.23 / >=24.4.24 com.vaadin:vaadin / 24.5.0 - 24.7.15 / >=24.7.16 com.vaadin:vaadin / 24.8.0 - 24.9.22 / >=24.9.23 com.vaadin:vaadin / 24.10.0 - 24.10.10 / >=24.10.11 com.vaadin:vaadin / 25.0.0 - 25.0.13 / >=25.2.10 com.vaadin:vaadin / 25.1.0 - 25.1.13 / >=25.2.10 com.vaadin:vaadin / 25.2.0 - 25.2.9 / >=25.2.10 com.vaadin:vaadin / 25.3.0 / >=25.3.1 com.vaadin:vaadin-charts-flow / 22.0.0 - 23.6.15 / >=23.6.16 com.vaadin:vaadin-charts-flow / 24.0.0 - 24.4.22 / >=24.4.24 com.vaadin:vaadin-charts-flow / 24.5.0 - 24.7.14 / >=24.7.15 com.vaadin:vaadin-charts-flow / 24.8.0 - 24.9.22 / >=24.9.23 com.vaadin:vaadin-charts-flow / 24.10.0 - 24.10.10 / >=24.10.11 com.vaadin:vaadin-charts-flow / 25.0.0 - 25.0.13 / >=25.2.10 com.vaadin:vaadin-charts-flow / 25.1.0 - 25.1.13 / >=25.2.10 com.vaadin:vaadin-charts-flow / 25.2.0 - 25.2.9 / >=25.2.10 com.vaadin:vaadin-charts-flow / 25.3.0 / >=25.3.1 com.vaadin:vaadin-charts-flow-svg-generator / 21.0.0 - 23.6.15 / >=23.6.16 com.vaadin:vaadin-charts-flow-svg-generator / 24.0.0 - 24.4.22 / >=24.4.24 com.vaadin:vaadin-charts-flow-svg-generator / 24.5.0 - 24.7.14 / >=24.7.15 com.vaadin:vaadin-charts-flow-svg-generator / 24.8.0 - 24.9.22 / >=24.9.23 com.vaadin:vaadin-charts-flow-svg-generator / 24.10.0 - 24.10.10 / >=24.10.11 com.vaadin:vaadin-charts-flow-svg-generator / 25.0.0 - 25.0.13 / >=25.2.10 com.vaadin:vaadin-charts-flow-svg-generator / 25.1.0 - 25.1.13 / >=25.2.10 com.vaadin:vaadin-charts-flow-svg-generator / 25.2.0 - 25.2.9 / >=25.2.10 com.vaadin:vaadin-charts-flow-svg-generator / 25.3.0 / >=25.3.1 npm packages npm package / Vulnerable versions / Fixed version @vaadin/charts / 22.0.0 - 23.6.6 / >=23.6.7 @vaadin/charts / 24.0.0 - 24.4.18 / >=24.4.19 @vaadin/charts / 24.5.0 - 24.7.12 / >=24.7.13 @vaadin/charts / 24.8.0 - 24.9.18 / >=24.9.19 @vaadin/charts / 24.10.0 - 24.10.6 / >=24.10.7 @vaadin/charts / 25.0.0 - 25.0.13 / >=25.2.14 @vaadin/charts / 25.1.0 - 25.1.14 / >=25.2.14 @vaadin/charts / 25.2.0 - 25.2.13 / >=25.2.14 @vaadin/charts / 25.3.0 / >=25.3.1
Vulnerability data from NVD (NIST) · CISA KEV · EPSS