CVE-2026-106138

In Progress® KendoReact @progress/kendo-react-charts starting with version 1.1.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a stri...

CVE-2026-106138

The In Progress® KendoReact (@progress/kendo-react-charts) component versions 1.1.0 through 16.2.0 are vulnerable to Cross-Site Scripting (XSS) . The root cause is that the default Chart tooltip renders formatted point values as raw HTML without proper encoding in both single-point and shared too...

EUVD-2026-96304

In Progress® KendoReact @progress/kendo-react-charts starting with version 1.1.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a stri...

CVE-2026-106138

In Progress® KendoReact @progress/kendo-react-charts starting with version 1.1.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a stri...

@mais-tech/renault-ui-library (>=0.1.132, <=0.1.144), amarpanchal-report-publish (>=1.3.73, <=1.3.85) +15 more potentially affected by CVE-2026-106138 via @progress/kendo-react-charts (>=3.18.0, <=9.5.0)

@progress/kendo-react-charts NPM version =3.18.0, =0.1.132, =1.3.73, =1.1.1, =2.1.3, =0.0.2, =0.0.1, =5.4.1, =1.3.33, =1.3.86, =1.7.2 and more Source cves: CVE-2026-106138 Source advisory: MEND:CVE-2026-106138...

PT-2026-109636

Name of the Vulnerable Software and Affected Versions @progress/kendo-react-charts versions 1.1.0 through 16.1.x Description The default Chart tooltip renders formatted point values as raw HTML without encoding in both single-point and shared tooltips. An attacker with low privileges who can...

CVE-2026-106138: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

In Progress® KendoReact @progress/kendo-react-charts starting with version 1.1.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a stri...

Malicious code in kendo-react-messages (npm)

--- Credit: OpenSSF source...

Progress: Multiple products have cross-site scripting vulnerabilities

Progress Telerik UI for ASP.NET Core and others are products of Progress, Inc.Progress Telerik UI for ASP.NET Core is a set of UI component libraries for building cross-platform responsive web applications.Progress Telerik UI for Progress Telerik UI for ASP.NET MVC is a library of UI components f...

CVE-2024-12629

In Progress® Telerik® KendoReact versions v3.5.0 through v9.4.0, an attacker can introduce or modify properties within the global prototype chain which can result in denial of service or command injection...

Progress Telerik KendoReact security vulnerabilities

Progress Telerik KendoReact is a powerful and flexible React UI component library from Progress USA. A security vulnerability exists in Progress Telerik KendoReact versions 3.5.0 through 9.1.0, which stems from an attacker being able to introduce or modify attributes in the global prototype chain...

MAL-2024-2579 Malicious code in kendo-react-messages (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in kendo-react-messages (npm)

--- -= Per source details. Do not edit below this line.=-...

Malware in @nexthink/kendo-react

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...