https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 13 Nov 2026 14:23:02 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-124688 <p>In Progress® Kendo® UI for jQuery prior to 2026.4.1111 the TabStrip, PanelBar, and Menu widgets support mapping a dataSource field to `spriteCssClass`. If an attacker can control the mapped data, they can break out of the attribute and inject markup, including event-handler attributes. The resulting JavaScript executes in the application&#39;s origin when a victim loads a page that renders the affected widget, allowing access to data and actions available in the victim&#39;s authenticated session.</p> <p>In Progress® Kendo® UI for jQuery prior to 2026.4.1111 the TabStrip, PanelBar, and Menu widgets support mapping a dataSource field to `spriteCssClass`. If an attacker can control the mapped data, they can break out of the attribute and inject markup, including event-handler attributes. The resulting JavaScript executes in the application&#39;s origin when a victim loads a page that renders the affected widget, allowing access to data and actions available in the victim&#39;s authenticated session.</p> https://db.gcve.eu/vuln/fkie_cve-2026-124688 https://db.gcve.eu/vuln/ghsa-rhfv-9jwg-f856 <p>In Progress® Kendo® UI for jQuery prior to 2026.4.1111 the TabStrip, PanelBar, and Menu widgets support mapping a dataSource field to `spriteCssClass`. If an attacker can control the mapped data, they can break out of the attribute and inject markup, including event-handler attributes. The resulting JavaScript executes in the application&#39;s origin when a victim loads a page that renders the affected widget, allowing access to data and actions available in the victim&#39;s authenticated session.</p> <p>In Progress® Kendo® UI for jQuery prior to 2026.4.1111 the TabStrip, PanelBar, and Menu widgets support mapping a dataSource field to `spriteCssClass`. If an attacker can control the mapped data, they can break out of the attribute and inject markup, including event-handler attributes. The resulting JavaScript executes in the application&#39;s origin when a victim loads a page that renders the affected widget, allowing access to data and actions available in the victim&#39;s authenticated session.</p> https://db.gcve.eu/vuln/ghsa-rhfv-9jwg-f856