Is CVE-2026-106144 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-106144 being exploited in the wild.

How severe is CVE-2026-106144?

Medium severity, with a CVSS score of 4.1, published 6 November 2026.

Which products and versions are affected?

Progress Software Kendo UI for Angular prior to 25.1.0; Progress Software Kendo-Angular-Common prior to 25.1.0; Progress Software Kendo-Angular-Scheduler prior to 25.1.0.

Is there a fix for CVE-2026-106144?

Yes: fixed in 25.1.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-106144 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-106144?

Check whether you run Progress Software Kendo UI for Angular, Progress Software Kendo-Angular-Common or Progress Software Kendo-Angular-Scheduler at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106144: Progress Kendo UI Angular prototype pollution in Scheduler

CVE-2026-106144 · Severity: medium · CVSS 4.1 · Published 2026-11-06

Progress Kendo UI for Angular is a component library used to build web applications with interactive calendars and scheduling features. A prototype pollution vulnerability in the Scheduler component allows a high-privileged attacker to manipulate the prototype of built-in objects, potentially compromising data integrity and application availability. This requires the attacker to already have control over field paths processed by the Scheduler component.

Technologies: Progress Software Kendo UI for Angular. Vendors: Progress Software.

Quick answers

Is CVE-2026-106144 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-106144 being exploited in the wild.
How severe is CVE-2026-106144?: Medium severity, with a CVSS score of 4.1, published 6 November 2026.
Which products and versions are affected?: Progress Software Kendo UI for Angular prior to 25.1.0; Progress Software Kendo-Angular-Common prior to 25.1.0; Progress Software Kendo-Angular-Scheduler prior to 25.1.0.
Is there a fix for CVE-2026-106144?: Yes: fixed in 25.1.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106144 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-106144?: Check whether you run Progress Software Kendo UI for Angular, Progress Software Kendo-Angular-Common or Progress Software Kendo-Angular-Scheduler at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 25.1.0

Technical details

Prototype pollution in the Scheduler component (@progress/kendo-angular-scheduler and @progress/kendo-angular-common) allows modification of built-in JavaScript object prototypes when a high-privileged attacker controls field path input processed by the component. The vulnerability affects versions prior to 25.1.0 and requires the attacker to have elevated privileges and influence over the data processed by the Scheduler.

Affected products

Progress Software Kendo UI for Angular prior to 25.1.0
Progress Software kendo-angular-scheduler prior to 25.1.0
Progress Software kendo-angular-common prior to 25.1.0

Timeline

2026-11-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.