https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-13T14:35:49.385198+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-124687 CVE-2026-124687 — Cross-Site Scripting in DropDownButton and SplitButton Items in Kendo UI for jQuery 2026-11-13T14:35:49.386316+00:00

Affected: Progress Software Kendo UI for jQuery

In Progress® Kendo® UI for jQuery versions from 2022.2.621 prior to 2026.4.1111 the DropDownButton and SplitButton allow markup injection through the `id` and `target` attributes. An attacker who can influence these item values can break out of the attributes and inject markup, including event handlers. The issue is fixed in 2026.4.1111.