CVE-2026-106142

Progress Software KendoReact versions 2.7.0 through 16.1.0 are vulnerable to a Cross-Site Scripting (XSS) flaw in the Editor component (@progress/kendo-react-editor). A low-privileged attacker capable of providing Editor content can execute arbitrary JavaScript in another user's browser by includ...