CVE-2026-106138

The In Progress® KendoReact (@progress/kendo-react-charts) component versions 1.1.0 through 16.2.0 are vulnerable to Cross-Site Scripting (XSS) . The root cause is that the default Chart tooltip renders formatted point values as raw HTML without proper encoding in both single-point and shared too...

EUVD-2024-51009

Malicious code in bioql PyPI...

CVE-2024-12629

In Progress® Telerik® KendoReact versions v3.5.0 through v9.4.0, an attacker can introduce or modify properties within the global prototype chain which can result in denial of service or command injection...

CVE-2024-12629

In Progress® Telerik® KendoReact versions v3.5.0 through v9.4.0, an attacker can introduce or modify properties within the global prototype chain which can result in denial of service or command injection...

CVE-2024-12629

Progress Telerik KendoReact (versions 3.5.0–9.4.0) is affected by a prototype pollution vulnerability where an attacker can modify properties on the global prototype chain, potentially leading to denial of service or command injection. The root cause is manipulation of global prototypes, enabling...

CVE-2024-12629 Prototype Pollution in Progress® Telerik® KendoReact

In Progress® Telerik® KendoReact versions v3.5.0 through v9.4.0, an attacker can introduce or modify properties within the global prototype chain which can result in denial of service or command injection...

CVE-2024-12629: Improperly Controlled Modification of Object Prototype Attributes

In Progress® Telerik® KendoReact versions v3.5.0 through v9.4.0, an attacker can introduce or modify properties within the global prototype chain which can result in denial of service or command injection...

PT-2025-6524 · Progress Telerik · Kendoreact

Name of the Vulnerable Software and Affected Versions: Progress® Telerik® KendoReact versions v3.5.0 through v9.4.0 Description: An attacker can introduce or modify properties within the global prototype chain, which can result in denial of service or command injection. Recommendations: For...