CVE-2026-107588: Vaadin Charts renders charts with the Highcharts library and pins an exact
- Severity
- 8.4 (HIGH)
- Vendor
- VAADIN
- Affected versions
- apply Highsoft's recommended workarounds to the bundled Highcharts when it loads
- Fixed version
- 23.6.16
- Patch status
- Patched
- Published
- 2026-10-21T19:16:57.847
- Modified
- 2026-10-21T19:16:57.847
Why it matters
High-severity vulnerability requiring prioritized review.
Recommended admin actions
- Review and patch based on exposure, asset criticality, and business impact.
- Compare installed versions against the affected version range in the advisory.
- Review logs for suspicious activity related to the affected application or component.
Technical summary
Vaadin Charts renders charts with the Highcharts library and pins an exact version of it, 9.2.2 in Vaadin 22 to 24 and 12.2.0 in Vaadin 25, so an application cannot remove these vulnerabilities by upgrading Highcharts on its own. Highsoft disclosed several vulnerabilities in that library that are reachable through the chart configuration: writes to Object.prototype through dotted series.keys paths, and cross-site scripting through credits.href, through breadcrumbs.style, through HTML text parsing while printing, and through xlink:href attributes in exported charts. An application is affected where data an attacker controls reaches the chart configuration, for example through additionalOptions, through updateConfiguration(), or through text options that accept markup. The fixed Vaadin versions apply Highsoft's recommended workarounds to the bundled Highcharts when it loads, and keep the same Highcharts version. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin 22.0.0 – 23.6.15 Vaadin 24.0.0 – 24.4.23 Vaadin 24.5.0 – 24.7.15 Vaadin 24.8.0 – 24.9.22 Vaadin 24.10.0 – 24.10.10 Vaadin 25.0.0 – 25.2.9 Vaadin 25.3.0 Mitigation Upgrade to 23.6.16 Upgrade to 24.4.24 Upgrade to 24.7.16 Upgrade to 24.9.23 Upgrade to 24.10.11 Upgrade to 25.2.10 Upgrade to 25.3.1 or newer Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version. Artifacts Maven coordinates / Vulnerable versions / Fixed version com.vaadin:vaadin / 22.0.0 – 23.6.15 / >=23.6.16 com.vaadin:vaadin / 24.0.0 – 24.4.23 / >=24.4.24 com.vaadin:vaadin / 24.5.0 – 24.7.15 / >=24.7.16 com.vaadin:vaadin / 24.8.0 – 24.9.22 / >=24.9.23 com.vaadin:vaadin / 24.10.0 – 24.10.10 / >=24.10.11 com.vaadin:vaadin / 25.0.0 – 25.0.13 / >=25.2.10 com.vaadin:vaadin / 25.1.0 – 25.1.13 / >=25.2.10 com.vaadin:vaadin / 25.2.0 – 25.2.9 / >=25.2.10 com.vaadin:vaadin / 25.3.0 / >=25.3.1 com.vaadin:vaadin-charts-flow / 22.0.0 – 23.6.15 / >=23.6.16 com.vaadin:vaadin-charts-flow / 24.0.0 – 24.4.22 / >=24.4.24 com.vaadin:vaadin-charts-flow / 24.5.0 – 24.7.14 / >=24.7.15 com.vaadin:vaadin-charts-flow / 24.8.0 – 24.9.22 / >=24.9.23 com.vaadin:vaadin-charts-flow / 24.10.0 – 24.10.10 / >=24.10.11 com.vaadin:vaadin-charts-flow / 25.0.0 – 25.0.13 / >=25.2.10 com.vaadin:vaadin-charts-flow / 25.1.0 – 25.1.13 / >=25.2.10 com.vaadin:vaadin-charts-flow / 25.2.0 – 25.2.9 / >=25.2.10 com.vaadin:vaadin-charts-flow / 25.3.0 / >=25.3.1 com.vaadin:vaadin-charts-flow-svg-generator / 21.0.0 – 23.6.15 / >=23.6.16 com.vaadin:vaadin-charts-flow-svg-generator / 24.0.0 – 24.4.22 / >=24.4.24 com.vaadin:vaadin-charts-flow-svg-generator / 24.5.0 – 24.7.14 / >=24.7.15 com.vaadin:vaadin-charts-flow-svg-generator / 24.8.0 – 24.9.22 / >=24.9.23 com.vaadin:vaadin-charts-flow-svg-generator / 24.10.0 – 24.10.10 / >=24.10.11 com.vaadin:vaadin-charts-flow-svg-generator / 25.0.0 – 25.0.13 / >=25.2.10 com.vaadin:vaadin-charts-flow-svg-generator / 25.1.0 – 25.1.13 / >=25.2.10 com.vaadin:vaadin-charts-flow-svg-generator / 25.2.0 – 25.2.9 / >=25.2.10 com.vaadin:vaadin-charts-flow-svg-generator / 25.3.0 / >=25.3.1 npm packages npm package / Vulnerable versions / Fixed version @vaadin/charts / 22.0.0 – 23.6.6 / >=23.6.7 @vaadin/charts / 24.0.0 – 24.4.18 / >=24.4.19 @vaadin/charts / 24.5.0 – 24.7.12 / >=24.7.13 @vaadin/charts / 24.8.0 – 24.9.18 / >=24.9.19 @vaadin/charts / 24.10.0 – 24.10.6 / >=24.10.7 @vaadin/charts / 25.0.0 – 25.0.13 / >=25.2.14 @vaadin/charts / 25.1.0 – 25.1.14 / >=25.2.14 @vaadin/charts / 25.2.0 – 25.2.13 / >=25.2.14 @vaadin/charts / 25.3.0 / >=25.3.1
View the official NVD record for CVE-2026-107588
CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.
VULNERABILITY PULSE
| AFFECTED PRODUCT | ACTION | ||
|---|---|---|---|
| CVE-2026-111832 |
WP Mailster PATCH
Reporter: AUDIT
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-105944 |
Apache Pulsar Manager is a web console for administering Apache Pulsar clusters. It
Reporter: SECURITY
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-111813 |
Apache Traffic Server: from 8.0.1 PATCH
Reporter: SECURITY
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-71195 |
Product identification pending PATCH
Reporter: CVE
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-111834 |
Mang Board WP PATCH
Reporter: AUDIT
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-76466 |
Cisco TelePresence Video Communication Server (VCS) Expressway
Reporter: PSIRT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-76473 |
Cisco Emergency Responder
Reporter: PSIRT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-76474 |
Cisco Emergency Responder
Reporter: PSIRT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-111183 |
GStreamer
Reporter: ZDI-DISCLOSURES
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-96639 |
Pillow PATCH
Reporter: SECURITY-ADVISORIES
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-113788 |
Lagoon is an application delivery platform for Kubernetes PATCH
Reporter: SECURITY-ADVISORIES
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-111811 |
Apache Traffic Server's experimental tsmemcache plugin PATCH
Reporter: SECURITY
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-112408 |
the default bucket() function in Amazon SageMaker Python SDK V3 PATCH
Reporter: FF89BA41-3AA1-4D27-914A-91399E9639E5
|
9.4
CRITICAL
|
VIEW RECORD |
| CVE-2026-114108 |
HKUDS Vibe-Trading from 0.1.0 PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-114119 |
Best Practice Software Bp Premier PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-113744 |
AC19
Reporter: CNA
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-111852 |
Ajax Search Lite PATCH
Reporter: AUDIT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-76475 |
Cisco Emergency Responder
Reporter: PSIRT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-114382 |
EX200
Reporter: CNA
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-114383 |
EX200
Reporter: CNA
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-114053 |
vLLM from 0.7.3 PATCH
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-114087 |
Trigger.dev PATCH
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-114403 |
PHPPresentation
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-109618 |
PHP
Reporter: SECURITY
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-109619 |
PHP
Reporter: SECURITY
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-105869 |
fixed PATCH
Reporter: SECURITY
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-114493 |
LocalAI
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-111816 |
Apache Traffic Server: from 8.0.0 PATCH
Reporter: SECURITY
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-114509 |
Laravel is a web application framework PATCH
Reporter: SECURITY-ADVISORIES
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-87095 |
ACRONIS
Reporter: SECURITY
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-89035 |
MikroTik RouterOS
Reporter: DISCLOSURE
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2025-31699 |
Apache Traffic Server: from 8.0.0 PATCH
Reporter: SECURITY
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-114139 |
sentry-javascript PATCH
Reporter: SECURITY-ADVISORIES
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-91403 |
the specified Component, e.g
Reporter: SECALERT_US
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-20043 |
Cisco Cyber Vision
Reporter: PSIRT
|
9
CRITICAL
|
VIEW RECORD |
| CVE-2026-113736 |
DHP-W610AV
Reporter: CNA
|
8.9
HIGH
|
VIEW RECORD |
| CVE-2026-114111 |
sharp PATCH
Reporter: DISCLOSURE
|
8.9
HIGH
|
VIEW RECORD |
| CVE-2026-114112 |
Sharp PATCH
Reporter: DISCLOSURE
|
8.9
HIGH
|
VIEW RECORD |
| CVE-2026-114085 |
Trigger.dev
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-82814 |
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
Reporter: SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-85683 |
Jane Menu PATCH
Reporter: CONTACT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-110369 |
WordPress Team Members – GS Plugins PATCH
Reporter: AUDIT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-110370 |
GS Plugins GS Pins for Pinterest gs-pinterest-portfolio
Reporter: AUDIT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-113779 |
pfSense-pkg-RESTAPI PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-76476 |
Cisco Emergency Responder
Reporter: PSIRT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-76477 |
Cisco Emergency Responder
Reporter: PSIRT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-76478 |
Cisco Emergency Responder
Reporter: PSIRT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-92206 |
CrewAI
Reporter: ZDI-DISCLOSURES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-92207 |
MindsDB
Reporter: ZDI-DISCLOSURES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-92208 |
NoMachine
Reporter: ZDI-DISCLOSURES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-111804 |
Apache Traffic Server's experimental wasm plugin PATCH
Reporter: SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-114135 |
Product identification pending PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-114140 |
Product identification pending PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-114142 |
toml-node is a TOML parser for Node.js and the browser PATCH
Reporter: SECURITY-ADVISORIES
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-103090 |
internal/controlplane/server.go) in Google OSS Agent Mesh (SAM) PATCH
Reporter: CVE-COORDINATION
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-76291 |
Splunk Enterprise
Reporter: PSIRT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-76298 |
Splunk Enterprise
Reporter: PSIRT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2025-71437 |
Astral uv PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-114045 |
FreeRDP PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-114052 |
vLLM after 0.24.0 and PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-114055 |
vLLM from 0.7.3 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-114063 |
SvelteKit (@sveltejs/kit) from 2.10.0 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-114089 |
Trigger.dev PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-114094 |
Dulwich PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-114102 |
adm-zip PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-114106 |
HKUDS Vibe-Trading from 0.1.0 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-114107 |
HKUDS Vibe-Trading from 0.1.0 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-114109 |
Product identification pending PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-114110 |
Astral uv PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-114197 |
Deserialization of untrusted data in Mandiant FLARE capa releases PATCH
Reporter: MANDIANT-CVE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-114198 |
Deserialization of untrusted data in Mandiant FLARE floss releases PATCH
Reporter: MANDIANT-CVE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-111074 |
Product identification pending PATCH
Reporter: EMO
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-111075 |
Product identification pending PATCH
Reporter: EMO
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-110938 |
Product identification pending
Reporter: EMO
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-114387 |
Shopper from 2.0.0 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-114405 |
Product identification pending PATCH
Reporter: 6B608899-1DA4-4A4D-8CFE-114101467AC1
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-114126 |
story files. If the Storybook Vitest addon is installed with an old PATCH
Reporter: SECURITY-ADVISORIES
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-105937 |
Apache Pulsar PATCH
Reporter: SECURITY
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-110803 |
VAADIN PATCH
Reporter: SECURITY
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-111810 |
APACHE PATCH
Reporter: SECURITY
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-114141 |
toml-node is a TOML parser for Node.js and the browser PATCH
Reporter: SECURITY-ADVISORIES
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-114143 |
toml-node is a TOML parser for Node.js and the browser PATCH
Reporter: SECURITY-ADVISORIES
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-114069 |
Trigger.dev PATCH
Reporter: DISCLOSURE
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-114083 |
Trigger.dev PATCH
Reporter: DISCLOSURE
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-92997 |
Click n Chat (Chat Widget Integration) PATCH
Reporter: CONTACT
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-92998 |
Click n Chat (Chat Widget Integration) PATCH
Reporter: CONTACT
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-76490 |
Cisco TelePresence Video Communication Server (VCS) Expressway
Reporter: PSIRT
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-114125 |
storybook PATCH
Reporter: SECURITY-ADVISORIES
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-113870 |
MONGODB
Reporter: CNA
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-114268 |
BE3L Pro
Reporter: CNA
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-29001 |
TastyIgniter
Reporter: DISCLOSURE
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-105044 |
Product identification pending PATCH
Reporter: MANDIANT-CVE
|
8.5
HIGH
|
VIEW RECORD |
| CVE-2026-70386 |
OxygenOS: from 16.1.0 PATCH
Reporter: A6D3DC9E-0591-4A13-BCE7-0F5B31FF6158
|
8.5
HIGH
|
VIEW RECORD |
| CVE-2026-114113 |
Sharp PATCH
Reporter: DISCLOSURE
|
8.4
HIGH
|
VIEW RECORD |
| CVE-2026-70387 |
Product identification pending PATCH
Reporter: A6D3DC9E-0591-4A13-BCE7-0F5B31FF6158
|
8.4
HIGH
|
VIEW RECORD |
| CVE-2026-107588 |
Vaadin Charts renders charts with the Highcharts library and pins an exact PATCH
Reporter: SECURITY
|
8.4
HIGH
|
VIEW RECORD |
| CVE-2020-37286 |
Vyper from 0.1.0b4 PATCH
Reporter: DISCLOSURE
|
8.3
HIGH
|
VIEW RECORD |
| CVE-2021-48018 |
Vyper from 0.2.13 PATCH
Reporter: DISCLOSURE
|
8.3
HIGH
|
VIEW RECORD |
| CVE-2021-48020 |
Vyper from 0.1.0b4 PATCH
Reporter: DISCLOSURE
|
8.3
HIGH
|
VIEW RECORD |
| CVE-2026-114081 |
Trigger.dev PATCH
Reporter: DISCLOSURE
|
8.3
HIGH
|
VIEW RECORD |
About the Vulnerability Pulse CVE Feed
The Vulnerability Pulse feed tracks live CVE advisories sourced from the National Vulnerability Database and vendor security disclosures. It is designed for SOC analysts, IT administrators, and security teams who need a fast, filterable view of current vulnerabilities without digging through raw NVD data.
How to Use the CVE Advisory Tracker
Use the severity filters to narrow results to Critical or High priority vulnerabilities. Filter by vendor to focus on software and hardware relevant to your environment. Export to CSV for reporting, ticketing, or patch prioritization workflows.
What Is a CVE Advisory?
A CVE (Common Vulnerabilities and Exposures) advisory is a public disclosure of a security vulnerability assigned a unique identifier by MITRE. Advisories include severity scores (CVSS), affected versions, and remediation guidance. Monitoring CVE advisories is a core function of vulnerability management programs and SOC operations.
CVE Analysis & Writeups
For in-depth analysis of specific vulnerabilities, visit the IT Knowledge Bases blog for CVE breakdowns, exploitation analysis, and remediation guidance written for security practitioners.