CVE-2026-106136

Cross-Site Scripting XSS in the Chat component @progress/kendo-react-conversational-ui in Progress Software KendoReact versions 0.6.0 through 16.1.0 allows a low-privileged attacker who can supply Chat messages to execute arbitrary JavaScript in the origin of the application via an unsafe URL in ...

CVE-2026-106135

Cross-Site Scripting XSS in the Chat component @progress/kendo-angular-conversational-ui in Progress Software Kendo UI for Angular versions prior to 25.3.0 allows a low-privileged attacker who can supply Chat messages to execute arbitrary JavaScript in another user's browser via an unsafe URL in ...

EUVD-2026-118364

Cross-Site Scripting XSS in the Chat component @progress/kendo-react-conversational-ui in Progress Software KendoReact versions 0.6.0 through 16.1.0 allows a low-privileged attacker who can supply Chat messages to execute arbitrary JavaScript in the origin of the application via an unsafe URL in ...

CVE-2026-106136 Cross-Site Scripting in Progress Software KendoReact

Cross-Site Scripting XSS in the Chat component @progress/kendo-react-conversational-ui in Progress Software KendoReact versions 0.6.0 through 16.1.0 allows a low-privileged attacker who can supply Chat messages to execute arbitrary JavaScript in the origin of the application via an unsafe URL in ...

CVE-2026-106136

Progress Software KendoReact versions 0.6.0 through 16.1.0 are vulnerable to Cross-Site Scripting (XSS) in the Chat component (@progress/kendo-react-conversational-ui). A low-privileged attacker capable of supplying Chat messages can execute arbitrary JavaScript within the application's origin. T...

CVE-2026-106135 Cross-Site Scripting in Progress Software Kendo UI for Angular

Cross-Site Scripting XSS in the Chat component @progress/kendo-angular-conversational-ui in Progress Software Kendo UI for Angular versions prior to 25.3.0 allows a low-privileged attacker who can supply Chat messages to execute arbitrary JavaScript in another user's browser via an unsafe URL in ...

EUVD-2026-118361

Cross-Site Scripting XSS in the Chat component @progress/kendo-angular-conversational-ui in Progress Software Kendo UI for Angular versions prior to 25.3.0 allows a low-privileged attacker who can supply Chat messages to execute arbitrary JavaScript in another user's browser via an unsafe URL in ...

CVE-2026-106135

Progress Software Kendo UI for Angular versions prior to 25.3.0 are vulnerable to Cross-Site Scripting (XSS) in the Chat component (@progress/kendo-angular-conversational-ui). A low-privileged attacker who can supply Chat messages can execute arbitrary JavaScript in another user's browser. The at...