{"vulnerability": "CVE-2026-106138", "sightings": [{"uuid": "a4f9867e-da70-4ed5-9f28-cf46802a5a45", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-106138", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117415900134656759", "content": "CVE-2026-106138 Cross-Site Scripting via Chart Tooltip in KendoReact In Progress\u00ae KendoReact (@progress/kendo-react-charts) starting with version 1.1.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a string value bound to the chart can supply HTML containing event handlers that execute JavaScript in a user's browser when the user hovers over the affected data point. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application.\nhttps://www.cve.org/CVERecord?id=CVE-2026-106138https://www.telerik.com/kendo-react-ui/components/knowledge-base/kb-security-chart-tooltip-xss-cve-2026-106138#ProgressSoftware #KendoReact#CVE_2026_106138#bot", "creation_timestamp": "2026-10-10T09:27:33.375645Z"}, {"uuid": "a4ef56a1-c947-44e0-b2a1-d3ee06b87adf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-1061389", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117415902779657984", "content": "CVE-2026-106139 Cross-Site Scripting via Chart Tooltip in Kendo UI for Vue In Progress\u00ae Kendo UI for Vue (@progress/kendo-vue-charts) starting with version 2.5.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a string value bound to the chart can supply HTML containing event handlers that execute JavaScript in a user's browser when the user hovers over the affected data point. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application.\nhttps://www.cve.org/CVERecord?id=CVE-2026-106139https://www.telerik.com/kendo-vue-ui/components/knowledge-base/kb-security-chart-tooltip-xss-cve-2026-1061389#ProgressSoftware #KendoUIforVue#CVE_2026_106139#bot", "creation_timestamp": "2026-10-10T09:28:14.596237Z"}]}