CVE-2026-106128mediumCWE-1321

CVE-2026-106128: medium-severity vulnerability in Progress Software Kendo UI for Vue

Prototype Pollution in Progress Software Kendo UI for Vue

Published

Follow this CVE+ Monitor Kendo UI for Vue

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

10Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.1
Prototype Pollution in @progress/kendo-vue-common in Progress Software Kendo UI for Vue versions 0.4.0 through 9.2.0 allows a high-privileged attacker who can control a field path processed by components such as the Scheduler to modify the prototype of built-in objects, resulting in a limited impact on confidentiality, integrity, and availability.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
Affected products
Progress Software · Kendo UI for Vue
Related CVEs — Progress Software Kendo UI for Vue

In the same product, most dangerous first.

CVE-2026-106139MEDIUMCross-Site Scripting via Chart Tooltip in Kendo UI for VueEPSS 0.1%CVE-2026-106143MEDIUMCross-Site Scripting in Progress Software Kendo UI for VueEPSS —