Dashboard / CVE-2026-106143

CVE-2026-106143

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 51/100
Published: 2026-11-06 Modified: 2026-11-10 First seen: 2026-11-06 Status: active

Attack Surface

Network Low Complexity Scope Change

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: Required
S: Changed
C: Low
I: Low
A: None

Description

Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-vue-editor) in Progress Software Kendo UI for Vue versions 2.7.1 through 10.0.0 allows a low-privileged attacker who can supply Editor content to execute arbitrary JavaScript in another user's browser via an unsafe URL entered in the Insert Link or Insert Image dialog, which runs when the user clicks the resulting link.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
Progress Software Kendo UI for Vue 2.7.1 < 10.1.0
Progress Software Kendo UI for Vue 2.7.1 < 10.1.0

References & Advisories (1)

Bug Bounty Relevance

51 / 100
✓ Network accessible
✓ Low complexity

CVSS Score

5.4 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS — Exploitation Probability

0.13%
Raw Score 0.001330
Percentile 2.9%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00133
2026-11-12
0.00133
2026-11-10
0.00133
2026-11-09
0.00133
2026-11-08
0.00133
2026-11-07
0.00133

Intelligence Sources

mitre ref →
nvd ref →

External Links