Security Operations
Threat Intelligence
🔎
❓

Threat Feed

Normalized, deduplicated intelligence. When several agencies report the same CVE, they are merged into one object showing all reporting sources.
DEMO MODE
HIGH
GHSA-r5wg-q8fc-p6w2 - Highcharts Grid parses pagination language options as HTML
NEAR-REAL-TIME
CVE-2026-118254 · GitHub Security Advisories · published 2026-10-28T19:57 · correlated from 2 sources
@highcharts
Source ↗
HIGH
GHSA-58g7-7f52-h92c - Highcharts Dashboards parses fullscreen labels as HTML
NEAR-REAL-TIME
CVE-2026-118253 · GitHub Security Advisories · published 2026-10-28T19:57 · correlated from 2 sources
@highcharts
Source ↗
HIGH
GHSA-rcqf-f6h2-ccg9 - Highcharts Dashboards parses sidebar component labels as HTML
NEAR-REAL-TIME
CVE-2026-118252 · GitHub Security Advisories · published 2026-10-28T19:56 · correlated from 2 sources
@highcharts
Source ↗
HIGH
GHSA-5793-x2q3-c3q7 - Highcharts: `javascript:` URL in credits.href runs script on click
NEAR-REAL-TIME
CVE-2026-118251 · GitHub Security Advisories · published 2026-10-28T19:56 · correlated from 3 sources
highchartsRed Hat
Source ↗
HIGH
GHSA-rmqc-xvr3-v46c - Highcharts: dotted series.keys paths write to Object.prototype
NEAR-REAL-TIME
CVE-2026-118250 · GitHub Security Advisories · published 2026-10-28T19:56 · correlated from 2 sources
highcharts
Source ↗
HIGH
GHSA-gfvx-2c2g-38wq - Highcharts: series column construction writes to Object.prototype
NEAR-REAL-TIME
CVE-2026-118249 · GitHub Security Advisories · published 2026-10-28T19:56 · correlated from 2 sources
highcharts
Source ↗
HIGH
GHSA-35rr-xwfh-x789 - Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes
NEAR-REAL-TIME
CVE-2026-118246 · GitHub Security Advisories · published 2026-10-28T19:56 · correlated from 3 sources
highchartsRed Hat
Source ↗
HIGH
GHSA-5ghw-9mgr-jvx2 - Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`
NEAR-REAL-TIME
CVE-2026-116797 · GitHub Security Advisories · published 2026-10-28T19:56 · correlated from 3 sources
@highchartsRed Hat
Source ↗
HIGH
GHSA-6g3c-p4fg-xv47 - Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`
NEAR-REAL-TIME
CVE-2026-118242 · GitHub Security Advisories · published 2026-10-28T19:55 · correlated from 3 sources
@highchartsRed Hat
Source ↗
HIGH
GHSA-grj7-r4jv-pw9j - Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace
NEAR-REAL-TIME
CVE-2026-118245 · GitHub Security Advisories · published 2026-10-28T19:55 · correlated from 2 sources
@highcharts
Source ↗
MEDIUM
GHSA-c75x-9x9h-28rm - Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column.
NEAR-REAL-TIME
CVE-2026-118247 · GitHub Security Advisories · published 2026-10-28T19:55 · correlated from 2 sources
@highcharts
Source ↗
MEDIUM
GHSA-jqgh-w3cc-7jqw - Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype`
NEAR-REAL-TIME
CVE-2026-118243 · GitHub Security Advisories · published 2026-10-28T19:55 · correlated from 2 sources
@highcharts
Source ↗
HIGH
GHSA-65hg-cf3f-5m39 - Highcharts Core: HTML text parsing falls back to unfiltered `innerHTML` during printing
NEAR-REAL-TIME
CVE-2026-118244 · GitHub Security Advisories · published 2026-10-28T19:55 · correlated from 3 sources
highchartsRed Hataws
Source ↗
HIGH
GHSA-mw4f-gj5x-6xr4 - Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts
NEAR-REAL-TIME
CVE-2026-116796 · GitHub Security Advisories · published 2026-10-28T19:55 · correlated from 3 sources
highchartsRed Hat
Source ↗
HIGH
GHSA-375p-5qhx-8wq4 - Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path
NEAR-REAL-TIME
CVE-2026-118650 · GitHub Security Advisories · published 2026-10-28T19:54 · correlated from 2 sources
github
Source ↗
MEDIUM
GHSA-h9g5-28mm-hx3g - Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob
NEAR-REAL-TIME
CVE-2026-118652 · GitHub Security Advisories · published 2026-10-28T19:54 · correlated from 2 sources
github
Source ↗
MEDIUM
GHSA-246p-cpwv-v3jq - Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration
NEAR-REAL-TIME
CVE-2026-118653 · GitHub Security Advisories · published 2026-10-28T19:53 · correlated from 2 sources
github
Source ↗
MEDIUM
GHSA-r7w9-592q-9vg4 - Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method
NEAR-REAL-TIME
CVE-2026-118266 · GitHub Security Advisories · published 2026-10-28T19:53 · correlated from 2 sources
github
Source ↗
MEDIUM
CVE-2026-114691 - gcc: Integer wrap in `std
NEAR-REAL-TIME
CVE-2026-114691 · Red Hat - CVE Feed · published 2026-10-28T19:53 · correlated from 2 sources
Red Hat
Source ↗
MEDIUM
GHSA-99jh-6h7p-pp36 - Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default
NEAR-REAL-TIME
CVE-2026-118651 · GitHub Security Advisories · published 2026-10-28T19:53 · correlated from 2 sources
github
Source ↗