PT-2026-111310 · Undefined · Undefined
CVE-2026-1061389
·
Published
2026-10-10
·
Updated
2026-10-10
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
🚨 CVE-2026-106139
In Progress® Kendo UI for Vue (@progress/kendo-vue-charts) starting with version 2.5.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a string value bound to the chart can supply HTML containing event handlers that execute JavaScript in a user's browser when the user hovers over the affected data point. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application.
🎖@cveNotify
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Undefined