Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6

Export CSV
CVE-2026-106127

Prototype Pollution in Progress Software KendoReact

Prototype Pollution in the setter utility (@progress/kendo-react-common) in Progress Software KendoReact versions 3.5.0 through 16.0.0 allows a high-privileged attacker who can control a field path passed to the utility, directly or through components such as the Form, Scheduler, and Gantt, to modify the prototype of built-in objects, resulting in a limited impact on confidentiality, integrity, and availability.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Kendoreact
CVE-2026-106134

Cross-Site Scripting in Progress Software KendoReact

Cross-Site Scripting (XSS) in the Menu component (@progress/kendo-react-layout) in Progress Software KendoReact versions 1.3.0 through 16.1.0 allows a low-privileged attacker who can influence the Menu item data to execute arbitrary JavaScript in the origin of the application via an unsafe URL in a Menu item, which runs when a user selects the item.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Kendoreact
CVE-2026-106136

Cross-Site Scripting in Progress Software KendoReact

Cross-Site Scripting (XSS) in the Chat component (@progress/kendo-react-conversational-ui) in Progress Software KendoReact versions 0.6.0 through 16.1.0 allows a low-privileged attacker who can supply Chat messages to execute arbitrary JavaScript in the origin of the application via an unsafe URL in an openUrl quick action, which runs when a user clicks the action.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Kendoreact
CVE-2026-106142

Cross-Site Scripting in Progress Software KendoReact

Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-react-editor) in Progress Software KendoReact versions 2.7.0 through 16.1.0 allows a low-privileged attacker who can supply Editor content to execute arbitrary JavaScript in another user's browser via a link with an unsafe URL in the Editor content, which runs when the user clicks the link.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Kendoreact
CVE-2026-106138

Cross-Site Scripting via Chart Tooltip in KendoReact

In Progress® KendoReact (@progress/kendo-react-charts) starting with version 1.1.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a string value bound to the chart can supply HTML containing event handlers that execute JavaScript in a user's browser when the user hovers over the affected data point. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Kendoreact
CVE-2024-12629

Prototype Pollution in Progress® Telerik® KendoReact

In Progress® Telerik® KendoReact versions v3.5.0 through v9.4.0, an attacker can introduce or modify properties within the global prototype chain which can result in denial of service or command injection.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Kendoreact