@vaadin/charts vulnerabilities
CVEs whose affected-version data names the @vaadin/charts package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-107588High· 8.4Multiple Vulnerabilities in the Highcharts Library Bundled with Vaadin Charts
Vaadin Charts renders charts with the Highcharts library and pins an exact version of it, 9.2.2 in Vaadin 22 to 24 and 12.2.0 in Vaadin 25, so an application cannot remove these vulnerabilities by upgrading Highcharts on its own. Highsof…
▾ Twilightvaadin · com.vaadin:vaadinEPSS 0.52%via CVEORG
CVE-2026-91860Medium· 6.3A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base
A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes ont…
▾ Sunlitvaadin · com.vaadin:vaadinEPSS 0.47%via NVD