Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-106135

Cross-Site Scripting in Progress Software Kendo UI for Angular

Cross-Site Scripting (XSS) in the Chat component (@progress/kendo-angular-conversational-ui) in Progress Software Kendo UI for Angular versions prior to 25.3.0 allows a low-privileged attacker who can supply Chat messages to execute arbitrary JavaScript in another user's browser via an unsafe URL in an openUrl quick action, which runs when the user clicks the action.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Kendo Ui For Angular
CVE-2026-106141

Cross-Site Scripting in Progress Software Kendo UI for Angular

Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-angular-editor) in Progress Software Kendo UI for Angular versions prior to 25.3.0 allows a low-privileged attacker who can supply Editor content to execute arbitrary JavaScript in another user's browser via a link or image with an unsafe URL in the Editor content, which runs when the user interacts with it.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Kendo Ui For Angular
CVE-2026-106144

Prototype Pollution in Progress Software Kendo UI for Angular

Prototype Pollution in the Scheduler component (@progress/kendo-angular-scheduler and @progress/kendo-angular-common) in Progress Software Kendo UI for Angular versions prior to 25.1.0 allows a high-privileged attacker who can control a field path processed by the Scheduler to modify the prototype of built-in objects, resulting in a limited impact on confidentiality, integrity, and availability.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Kendo Ui For Angular