CVE Watch15 de out. de 2026

CVE-2026-106138

In Progress® KendoReact (@progress/kendo-react-charts) starting with version 1.1.0 and prior to 16.2.0, the default Chart tooltip renders th

CVSS

5.4

Média

EPSS

0.1%

KEV

—

Exploit Today

0-100

Publicado: 10 de out. de 2026 · Última mod.: 15 de out. de 2026 · CWE-80

EPSS · 30d

0.1%EPSS · 30 dias0.2%

2026-10-102026-11-05

Descrição técnica

In Progress® KendoReact (@progress/kendo-react-charts) starting with version 1.1.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a string value bound to the chart can supply HTML containing event handlers that execute JavaScript in a user's browser when the user hovers over the affected data point. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application.

Referências oficiais

www.telerik.comhttps://www.telerik.com/kendo-react-ui/components/knowledge-base/kb-security-chart-tooltip-xss-cve-2026-106138

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-765636.1 MÉD

—

——0Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Fileorbis Informatics Services Trade Inc. Fileorbis allows Using Malicious Files. This issue affects Fileorbis: before 12.5.4.1d CVE-2026-111040—

14.4%

——4The platform allows persistent HTML injection into editable fields managed by TinyMCE. An authenticated attacker with low privileges can inject unsanitised HTML content which is stored in the database and subsequently rendered in other users’ browsers, affecting the display of content within the application.2d CVE-2026-1168584.3 MÉD

6.8%

——2Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WPMU DEV Forminator forminator allows Code Injection.This issue affects Forminator: from n/a through 1.58.3.2d CVE-2026-620575.3 MÉD

22.8%

——7Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Fahim Reza Divi Contact Form 7 cf7-styler-for-divi allows Code Injection.This issue affects Divi Contact Form 7: from n/a through 4.1.0.7d CVE-2026-527105.3 MÉD

22.8%

——7Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ithemelandco GIFTiT – Free Gifts for WooCommerce ithemeland-free-gifts-for-woo allows Code Injection.This issue affects GIFTiT – Free Gifts for WooCommerce: from n/a through 4.5.7d CVE-2026-1194795.3 MÉD

24.4%

——7Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.6.7.1.7d