https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sun, 11 Oct 2026 07:30:30 +0000 https://vulnerability.circl.lu/sighting/ba716b26-04da-42c0-a534-a4a931e3e47a/export {"uuid": "ba716b26-04da-42c0-a534-a4a931e3e47a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-106139", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117415902779657984", "content": "CVE-2026-106139 Cross-Site Scripting via Chart Tooltip in Kendo UI for Vue In Progress\u00ae Kendo UI for Vue (@progress/kendo-vue-charts) starting with version 2.5.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a string value bound to the chart can supply HTML containing event handlers that execute JavaScript in a user's browser when the user hovers over the affected data point. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application.\nhttps://www.cve.org/CVERecord?id=CVE-2026-106139https://www.telerik.com/kendo-vue-ui/components/knowledge-base/kb-security-chart-tooltip-xss-cve-2026-1061389#ProgressSoftware #KendoUIforVue#CVE_2026_106139#bot", "creation_timestamp": "2026-10-10T09:28:14.569960Z"} {"uuid": "ba716b26-04da-42c0-a534-a4a931e3e47a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-106139", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117415902779657984", "content": "CVE-2026-106139 Cross-Site Scripting via Chart Tooltip in Kendo UI for Vue In Progress\u00ae Kendo UI for Vue (@progress/kendo-vue-charts) starting with version 2.5.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a string value bound to the chart can supply HTML containing event handlers that execute JavaScript in a user's browser when the user hovers over the affected data point. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application.\nhttps://www.cve.org/CVERecord?id=CVE-2026-106139https://www.telerik.com/kendo-vue-ui/components/knowledge-base/kb-security-chart-tooltip-xss-cve-2026-1061389#ProgressSoftware #KendoUIforVue#CVE_2026_106139#bot", "creation_timestamp": "2026-10-10T09:28:14.569960Z"} https://vulnerability.circl.lu/sighting/ba716b26-04da-42c0-a534-a4a931e3e47a/export Sat, 10 Oct 2026 09:28:14 +0000