CVE-2026-106135mediumCWE-79

CVE-2026-106135: medium-severity vulnerability in Progress Software Kendo UI for Angular

Cross-Site Scripting in Progress Software Kendo UI for Angular

Published

Follow this CVE+ Monitor Kendo UI for Angular

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

10Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.4
Cross-Site Scripting (XSS) in the Chat component (@progress/kendo-angular-conversational-ui) in Progress Software Kendo UI for Angular versions prior to 25.3.0 allows a low-privileged attacker who can supply Chat messages to execute arbitrary JavaScript in another user's browser via an unsafe URL in an openUrl quick action, which runs when the user clicks the action.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected products
Progress Software · Kendo UI for Angular
Related CVEs — Progress Software Kendo UI for Angular

In the same product, most dangerous first.

CVE-2025-6725MEDIUMCross-Site Scripting (XSS) in PdfViewerEPSS 0.3%CVE-2026-106144MEDIUMPrototype Pollution in Progress Software Kendo UI for AngularEPSS —CVE-2026-106141MEDIUMCross-Site Scripting in Progress Software Kendo UI for AngularEPSS —