Is CVE-2026-106128 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-106128 being exploited in the wild.

How severe is CVE-2026-106128?

Medium severity, with a CVSS score of 4.1, published 6 November 2026.

Which products and versions are affected?

Progress Software Kendo UI for Vue 0.4.0 through 9.2.0.

Is there a fix for CVE-2026-106128?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-106128 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-106128?

Check whether you run Progress Software Kendo UI for Vue at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106128: Progress Kendo UI for Vue prototype pollution in field path processing

CVE-2026-106128 · Severity: medium · CVSS 4.1 · Published 2026-11-06

Kendo UI for Vue is a component library used in web applications. A vulnerability allows an attacker with high privilege to modify core JavaScript object prototypes through field path processing in components like the Scheduler, potentially leading to data corruption, unauthorized access, or application malfunction.

Vendors: Progress Software.

Quick answers

Is CVE-2026-106128 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-106128 being exploited in the wild.
How severe is CVE-2026-106128?: Medium severity, with a CVSS score of 4.1, published 6 November 2026.
Which products and versions are affected?: Progress Software Kendo UI for Vue 0.4.0 through 9.2.0.
Is there a fix for CVE-2026-106128?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-106128 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-106128?: Check whether you run Progress Software Kendo UI for Vue at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Prototype pollution vulnerability in the @progress/kendo-vue-common library allows modification of built-in JavaScript object prototypes when a high-privileged attacker can control field paths processed by components such as Scheduler. The vulnerability affects versions 0.4.0 through 9.2.0 and requires attacker control over input fields but results in only limited impact on confidentiality, integrity, and availability.

Affected products

Progress Software Kendo UI for Vue 0.4.0 through 9.2.0

Timeline

2026-11-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.