CVE-2026-106136

Cross-Site Scripting XSS in the Chat component @progress/kendo-react-conversational-ui in Progress Software KendoReact versions 0.6.0 through 16.1.0 allows a low-privileged attacker who can supply Chat messages to execute arbitrary JavaScript in the origin of the application via an unsafe URL in ...