{"metadata": {"vulnerability": "cve-2026-1061389", "count": 1, "kinds": {"milestone": 0, "sighting": 1, "kev": 0, "other": 0}}, "data": [{"timestamp": "2026-10-10T09:28:14.596Z", "date_only": false, "value": "2026-10-10T09:28:14.596237Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117415902779657984", "record": "cve-2026-1061389", "field": "creation_timestamp", "uuid": "a4ef56a1-c947-44e0-b2a1-d3ee06b87adf", "content": "CVE-2026-106139 Cross-Site Scripting via Chart Tooltip in Kendo UI for Vue In Progress\u00ae Kendo UI for Vue (@progress/kendo-vue-charts) starting with version 2.5.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a string value bound to the chart can supply HTML containing event handlers that execute JavaScript in a user's browser when the user hovers over the affected data point. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application.\nhttps://www.cve.org/CVERecord?id=CVE-2026-106139https://www.telerik.com/kendo-vue-ui/components/knowledge-base/kb-security-chart-tooltip-xss-cve-2026-1061389#ProgressSoftware #KendoUIforVue#CVE_2026_106139#bot", "url": "https://infosec.exchange/users/cve/statuses/117415902779657984"}]}