CVE-2026-106136: falha de média gravidade em Progress Software KendoReact
Cross-Site Scripting in Progress Software KendoReact
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
10Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.4
Cross-Site Scripting (XSS) in the Chat component (@progress/kendo-react-conversational-ui) in Progress Software KendoReact versions 0.6.0 through 16.1.0 allows a low-privileged attacker who can supply Chat messages to execute arbitrary JavaScript in the origin of the application via an unsafe URL in an openUrl quick action, which runs when a user clicks the action.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
Progress Software · KendoReactCVEs relacionadas — Progress Software KendoReact
No mesmo produto, das mais perigosas para as menos.
CVE-2025-6725MEDIUMCross-Site Scripting (XSS) in PdfViewerEPSS 0.3%CVE-2026-106138MEDIUMCross-Site Scripting via Chart Tooltip in KendoReactEPSS 0.1%CVE-2026-106127MEDIUMPrototype Pollution in Progress Software KendoReactEPSS —CVE-2026-106142MEDIUMCross-Site Scripting in Progress Software KendoReactEPSS —CVE-2026-106134MEDIUMCross-Site Scripting in Progress Software KendoReactEPSS —