CVE-2026-106134

Progress Software KendoReact versions 1.3.0 through 16.1.0 are vulnerable to a Cross-Site Scripting (XSS) flaw in the Menu component (@progress/kendo-react-layout). A low-privileged attacker capable of influencing the Menu item data can execute arbitrary JavaScript within the application's origin...