Vendors / Plotly Records 4 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 1
CVSS high 1
Exploited now Plotly records in CISA KEV No Plotly vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 62
Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the package dash before 2.15.0; versions of the package dash-html-components before 2.0.0…
CVSS 3.1 MEDIUM 6.5· Network · Low privileges · User interaction · EPSS 0.01487 · Published 2024-02-02 · Fixed in 2.13.0, 2.0.0 +2 CWE-79
Priority MEDIUM 51
In Plotly plotly.js before 2.25.2, plot API calls have a risk of __proto__ being polluted in expandObjectPaths or nestedProperty.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00936 · Published 2024-01-03 · Fixed in 2.25.2 CWE-1321
Priority LOW 38
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Plotly.js Graphing allows Object Injection.
CVSS 3.1 HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00433 · Published 2026-07-10 · Fixed in 3.0.2 CWE-915
Priority LOW 29
Plotly, Inc. plotly.js versions prior to 1.16.0 are vulnerable to an XSS issue.
CVSS 3.0 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00878 · Published 2017-07-13 · Fixed in 1.16.0 CWE-79
Open these records in search → All records by CVSS severity
1 1 2 0 0
