Prototype Pollution in the Scheduler component (@progress/kendo-angular-scheduler and @progress/kendo-angular-common) in Progress Software Kendo UI for Angular versions prior to 25.1.0 allows a high-privileged attacker who can control a field path processed by the Scheduler to modify the prototype of built-in objects, resulting in a limited impact on confidentiality, integrity, and availability.
Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-vue-editor) in Progress Software Kendo UI for Vue versions 2.7.1 through 10.0.0 allows a low-privileged attacker who can supply Editor content to execute arbitrary JavaScript in another user's browser via an unsafe URL entered in the Insert Link or Insert Image dialog, which runs when the user clicks the resulting link.
Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-react-editor) in Progress Software KendoReact versions 2.7.0 through 16.1.0 allows a low-privileged attacker who can supply Editor content to execute arbitrary JavaScript in another user's browser via a link with an unsafe URL in the Editor content, which runs when the user clicks the link.
The zero2-baileys npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, secure computer. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control over the system.
Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-angular-editor) in Progress Software Kendo UI for Angular versions prior to 25.3.0 allows a low-privileged attacker who can supply Editor content to execute arbitrary JavaScript in another user's browser via a link or image with an unsafe URL in the Editor content, which runs when the user interacts with it.
The arc-contracts npm package contains malicious code that compromises any computer on which it is installed or running. This compromise potentially grants full control to an outside entity, risking exposure of all secrets and keys stored on the affected system. Immediate removal of the package and rotation of all secrets from a different, uncompromised machine is strongly advised.
The npm package 'kc-kline-chart' contains malicious code that fully compromises any computer on which it is installed or running. This compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Immediate removal of the package is advised, but due to the extent of the compromise, complete remediation cannot be guaranteed by removal alone.
The securedrop-app npm package contains malicious code that compromises any computer on which it is installed or running. This compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a separate, uncompromised device. Simply removing the package does not guarantee removal of all malicious software introduced by it.
The evmos-contracts npm package contains malicious code that compromises any computer on which it is installed or running. Systems affected by this package should be considered fully compromised, and all secrets and keys stored on those systems must be rotated immediately from a separate, secure device. Removing the package alone does not guarantee the removal of all malicious software introduced by it.
Cross-Site Scripting (XSS) in the Chat component (@progress/kendo-react-conversational-ui) in Progress Software KendoReact versions 0.6.0 through 16.1.0 allows a low-privileged attacker who can supply Chat messages to execute arbitrary JavaScript in the origin of the application via an unsafe URL in an openUrl quick action, which runs when a user clicks the action.
CVE-2026-62854 is a cross-site scripting (XSS) vulnerability in FreeScout versions prior to 1.8.225. It allows a user with permission to edit mailbox signatures to inject scriptable content by combining uploaded files and nested tag fragments that bypass sanitization. The malicious script executes with the victim's privileges when they open the mailbox reply editor or new-ticket page. This vulnerability is fixed in FreeScout version 1.8.225.
CVE-2026-106134 is a Cross-Site Scripting (XSS) vulnerability in the Menu component of Progress Software's KendoReact library. It affects versions 1.3.0 through 16.1.0. A low-privileged attacker who can influence the Menu item data can inject unsafe URLs that execute arbitrary JavaScript when a user selects the malicious menu item. This vulnerability has been fixed in version 16.2.0.
CVE-2026-106135 is a Cross-Site Scripting (XSS) vulnerability in the Chat component of Progress Software's Kendo UI for Angular versions prior to 25.3.0. It allows a low-privileged attacker who can supply chat messages to execute arbitrary JavaScript in another user's browser by exploiting an unsafe URL in an openUrl quick action. The vulnerability is fixed in version 25.3.0.
The Symfony Serializer component ObjectNormalizer treats any attribute name containing . (and, from Symfony 6.4, [) as a writable property path, allowing untrusted input to modify properties of nested objects and bypass their #[Ignore] metadata attribute in Symfony versions 5.4.41 prior to 5.4.56, 6.4.9 prior to 6.4.50, 7.0.9 prior to 7.1.0, 7.1.2 prior to 7.4.23, and 8.x prior to 8.1.11.
ObjectNormalizer::isAllowedAttribute() accepts such names, and setAttributeValue() hands the name straight to PropertyAccessor::setValue(), which parses it as a property path and traverses into the nested object. A payload key such as customer.admin writes to $order->customer->admin. The #[Ignore] metadata attribute is only consulted when the nested object is denormalized in its own right, never when it is reached through a path. #[Groups] restrictions are not bypassed: the path is only accepted when no groups are passed in the context, and then groups restrict nothing. When the root class carries neither #[Ignore] nor #[Groups], no allowlist applies and every key of the payload is let through. Because PropertyAccessor also resolves a path segment against public methods, a segment matching a public method name invokes that method with the attacker’s value.Applications that bind untrusted input to objects are affected, including controllers using #[MapRequestPayload] or #[MapQueryString], whose default normalizer is ObjectNormalizer. With OBJECT_TO_POPULATE, as used for partial updates, the traversal reaches an already hydrated entity graph, and the modified field may be persisted.
The fix accepts a property path only when the class metadata declares an attribute of that exact name. Declared paths keep working unchanged, and a path in the payload with no matching declaration is ignored.
Improper neutralization of input in the sessions grid in Progress Telerik Fiddler Everywhere 8.3.0 and earlier allows an attacker to execute backend IPC commands by convincing a user to open a specially crafted SAZ file.
Missing integrity verification in the Progress Software Fiddler Download and Setup Skill on Linux, macOS, and Windows which allows an attacker to compromise or influence a release component and execute attacker-controlled code when a user runs the skill. On macOS, the skill stages the package at a predictable path and installs it with administrator privileges, which may allow code execution with root privileges after user approval. A local process may also replace the staged macOS package while the skill waits for approval.
CVE-2026-118515 is a high-severity vulnerability in the Symfony Serializer component affecting versions prior to 5.4.56, 6.4.50, 7.4.23, and 8.1.11. It allows an attacker to craft a request that causes the application to treat arbitrary files on the server as uploaded files without actual upload, potentially exposing or moving sensitive files. This occurs because the DataUriNormalizer only handles specific types, and subclasses like UploadedFile can be instantiated with attacker-controlled paths, bypassing normal upload checks.
CVE-2026-123859 is a SQL injection vulnerability in the Snowflake Connector for Python and its Universal Core variant. When identifier escaping is disabled via a non-default configuration, the write_pandas() function fails to escape DataFrame column names before embedding them in SQL statements. This allows crafted column names to inject additional SQL commands, potentially enabling unauthorized reading, modification, or deletion of data accessible to the Snowflake role used by the application. Exploitation requires attacker-controlled column names passed to this functionality. Fixed versions 4.8.1 and 5.2.0 are available and users must upgrade manually.