CVE-2026-106127

Progress Software KendoReact versions 3.5.0 through 16.0.0 are vulnerable to a Prototype Pollution flaw within the setter utility (@progress/kendo-react-common). A high-privileged attacker capable of controlling a field path—either directly or through components like Form , Scheduler , and Gantt ...