https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-13T14:26:10.213747+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-124696 CVE-2026-124696 — Cross-Site Scripting in Kendo UI for jQuery Spreadsheet Sheet Names 2026-11-13T14:26:10.215441+00:00

Affected: Progress Software Kendo UI for jQuery

In Progress Kendo UI for jQuery, Spreadsheet sheet names are inserted into the SheetsBar menu button's data-sheet-name attribute without encoding. An attacker who can influence a sheet name can inject an event-handler attribute and execute JavaScript when a user hovers over the menu button. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected version is 2024.4.1112; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111.