EUVD-2026-118366

Cross-Site Scripting XSS in the Editor component @progress/kendo-react-editor in Progress Software KendoReact versions 2.7.0 through 16.1.0 allows a low-privileged attacker who can supply Editor content to execute arbitrary JavaScript in another user's browser via a link with an unsafe URL in the...

EUVD-2026-118362

Cross-Site Scripting XSS in the Menu component @progress/kendo-react-layout in Progress Software KendoReact versions 1.3.0 through 16.1.0 allows a low-privileged attacker who can influence the Menu item data to execute arbitrary JavaScript in the origin of the application via an unsafe URL in a...

CVE-2026-106142

Cross-Site Scripting XSS in the Editor component @progress/kendo-react-editor in Progress Software KendoReact versions 2.7.0 through 16.1.0 allows a low-privileged attacker who can supply Editor content to execute arbitrary JavaScript in another user's browser via a link with an unsafe URL in the...

CVE-2026-106134

Cross-Site Scripting XSS in the Menu component @progress/kendo-react-layout in Progress Software KendoReact versions 1.3.0 through 16.1.0 allows a low-privileged attacker who can influence the Menu item data to execute arbitrary JavaScript in the origin of the application via an unsafe URL in a...

CVE-2026-106127

Prototype Pollution in the setter utility @progress/kendo-react-common in Progress Software KendoReact versions 3.5.0 through 16.0.0 allows a high-privileged attacker who can control a field path passed to the utility, directly or through components such as the Form, Scheduler, and Gantt, to modi...

CVE-2026-106127 Prototype Pollution in Progress Software KendoReact

Prototype Pollution in the setter utility @progress/kendo-react-common in Progress Software KendoReact versions 3.5.0 through 16.0.0 allows a high-privileged attacker who can control a field path passed to the utility, directly or through components such as the Form, Scheduler, and Gantt, to modi...

CVE-2026-106127

Progress Software KendoReact versions 3.5.0 through 16.0.0 are vulnerable to a Prototype Pollution flaw within the setter utility (@progress/kendo-react-common). A high-privileged attacker capable of controlling a field path—either directly or through components like Form , Scheduler , and Gantt ...

CVE-2026-106142

Progress Software KendoReact versions 2.7.0 through 16.1.0 are vulnerable to a Cross-Site Scripting (XSS) flaw in the Editor component (@progress/kendo-react-editor). A low-privileged attacker capable of providing Editor content can execute arbitrary JavaScript in another user's browser by includ...

CVE-2026-106142 Cross-Site Scripting in Progress Software KendoReact

Cross-Site Scripting XSS in the Editor component @progress/kendo-react-editor in Progress Software KendoReact versions 2.7.0 through 16.1.0 allows a low-privileged attacker who can supply Editor content to execute arbitrary JavaScript in another user's browser via a link with an unsafe URL in the...

CVE-2026-106136

Progress Software KendoReact versions 0.6.0 through 16.1.0 are vulnerable to Cross-Site Scripting (XSS) in the Chat component (@progress/kendo-react-conversational-ui). A low-privileged attacker capable of supplying Chat messages can execute arbitrary JavaScript within the application's origin. T...

CVE-2026-106134 Cross-Site Scripting in Progress Software KendoReact

Cross-Site Scripting XSS in the Menu component @progress/kendo-react-layout in Progress Software KendoReact versions 1.3.0 through 16.1.0 allows a low-privileged attacker who can influence the Menu item data to execute arbitrary JavaScript in the origin of the application via an unsafe URL in a...

CVE-2026-106134

Progress Software KendoReact versions 1.3.0 through 16.1.0 are vulnerable to a Cross-Site Scripting (XSS) flaw in the Menu component (@progress/kendo-react-layout). A low-privileged attacker capable of influencing the Menu item data can execute arbitrary JavaScript within the application's origin...