Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-124698 (GCVE-0-2026-124698)

Vulnerability from nvd – Published: 2026-11-12 17:09 – Updated: 2026-11-12 17:09

Title

Cross-Site Scripting in Kendo UI for jQuery Chart Shared Tooltip

Summary

In Progress Kendo UI for jQuery, the Chart default tooltip renders point values as raw HTML. An attacker who can influence a string point value can inject markup that executes as JavaScript when a user hovers over the point. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. Version 2016.2.607 or earlier may be affected, but earlier releases have not been verified. The latest vulnerable version is 2026.3.1015; the issue is fixed in version 2026.4.1111.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 79/100 over 205 records in the last 180 days details

References

1 reference

URL	Tags
https://www.telerik.com/kendo-jquery-ui/documenta…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress Software	Kendo UI for jQuery	Affected: 2016.2.607 , ≤ 2026.3.1015 (custom)

Credits

Abhishek Nandkumar Bhaskar (Abhi-Hackz)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Kendo UI for jQuery",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThanOrEqual": "2026.3.1015",
              "status": "affected",
              "version": "2016.2.607",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abhishek Nandkumar Bhaskar (Abhi-Hackz)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Progress Kendo UI for jQuery, the Chart default tooltip renders point values as raw HTML. An attacker who can influence a string point value can inject markup that executes as JavaScript when a user hovers over the point. Successful exploitation may compromise the confidentiality and integrity of data available in the user\u0027s browser context. Version 2016.2.607 or earlier may be affected, but earlier releases have not been verified. The latest vulnerable version is 2026.3.1015; the issue is fixed in version 2026.4.1111.\u003c/p\u003e"
            }
          ],
          "value": "In Progress Kendo UI for jQuery, the Chart default tooltip renders point values as raw HTML. An attacker who can influence a string point value can inject markup that executes as JavaScript when a user hovers over the point. Successful exploitation may compromise the confidentiality and integrity of data available in the user\u0027s browser context. Version 2016.2.607 or earlier may be affected, but earlier releases have not been verified. The latest vulnerable version is 2026.3.1015; the issue is fixed in version 2026.4.1111."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-63",
          "descriptions": [
            {
              "lang": "en",
              "value": "Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-12T17:09:34.698Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-kendo-chart-tooltip-point-value-xss-cve-2026-124698"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Cross-Site Scripting in Kendo UI for jQuery Chart Shared Tooltip",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-124698",
    "datePublished": "2026-11-12T17:09:34.698Z",
    "dateReserved": "2026-11-09T10:41:43.933Z",
    "dateUpdated": "2026-11-12T17:09:34.698Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124697 (GCVE-0-2026-124697)

Vulnerability from nvd – Published: 2026-11-12 17:06 – Updated: 2026-11-12 17:06

Title

Cross-Site Scripting in Kendo UI for jQuery Chart Shared Tooltip

Summary

In Progress Kendo UI for jQuery, Chart shared-tooltip rendering treats bound category and series-name values as raw HTML. An attacker who can influence values consumed by an affected Chart can inject markup that executes as JavaScript when a user displays the shared tooltip. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. Version 2016.2.607 or earlier may be affected, but earlier releases have not been verified. The latest vulnerable version is 2026.3.1015; the issue is fixed in version 2026.4.1111.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 79/100 over 205 records in the last 180 days details

References

1 reference

URL	Tags
https://www.telerik.com/kendo-jquery-ui/documenta…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress Software	Kendo UI for jQuery	Affected: 2016.2.607 , ≤ 2026.3.1015 (custom)

Credits

Abhishek Nandkumar Bhaskar (Abhi-Hackz)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Kendo UI for jQuery",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThanOrEqual": "2026.3.1015",
              "status": "affected",
              "version": "2016.2.607",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abhishek Nandkumar Bhaskar (Abhi-Hackz)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Progress Kendo UI for jQuery, Chart shared-tooltip rendering treats bound category and series-name values as raw HTML. An attacker who can influence values consumed by an affected Chart can inject markup that executes as JavaScript when a user displays the shared tooltip. Successful exploitation may compromise the confidentiality and integrity of data available in the user\u0027s browser context. Version 2016.2.607 or earlier may be affected, but earlier releases have not been verified. The latest vulnerable version is 2026.3.1015; the issue is fixed in version 2026.4.1111.\u003c/p\u003e"
            }
          ],
          "value": "In Progress Kendo UI for jQuery, Chart shared-tooltip rendering treats bound category and series-name values as raw HTML. An attacker who can influence values consumed by an affected Chart can inject markup that executes as JavaScript when a user displays the shared tooltip. Successful exploitation may compromise the confidentiality and integrity of data available in the user\u0027s browser context. Version 2016.2.607 or earlier may be affected, but earlier releases have not been verified. The latest vulnerable version is 2026.3.1015; the issue is fixed in version 2026.4.1111."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-63",
          "descriptions": [
            {
              "lang": "en",
              "value": "Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-12T17:06:27.602Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-kendo-chart-shared-tooltip-xss-cve-2026-124697"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Cross-Site Scripting in Kendo UI for jQuery Chart Shared Tooltip",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-124697",
    "datePublished": "2026-11-12T17:06:27.602Z",
    "dateReserved": "2026-11-09T10:41:43.933Z",
    "dateUpdated": "2026-11-12T17:06:27.602Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124696 (GCVE-0-2026-124696)

Vulnerability from nvd – Published: 2026-11-12 17:02 – Updated: 2026-11-12 17:02

Title

Cross-Site Scripting in Kendo UI for jQuery Spreadsheet Sheet Names

Summary

In Progress Kendo UI for jQuery, Spreadsheet sheet names are inserted into the SheetsBar menu button's data-sheet-name attribute without encoding. An attacker who can influence a sheet name can inject an event-handler attribute and execute JavaScript when a user hovers over the menu button. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected version is 2024.4.1112; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 79/100 over 205 records in the last 180 days details

References

1 reference

URL	Tags
https://www.telerik.com/kendo-jquery-ui/documenta…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress Software	Kendo UI for jQuery	Affected: 2024.4.1112 , ≤ 2026.3.1015 (custom)

Credits

Abhishek Nandkumar Bhaskar (Abhi-Hackz)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Kendo UI for jQuery",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThanOrEqual": "2026.3.1015",
              "status": "affected",
              "version": "2024.4.1112",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abhishek Nandkumar Bhaskar (Abhi-Hackz)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Progress Kendo UI for jQuery, Spreadsheet sheet names are inserted into the SheetsBar menu button\u0027s data-sheet-name attribute without encoding. An attacker who can influence a sheet name can inject an event-handler attribute and execute JavaScript when a user hovers over the menu button. Successful exploitation may compromise the confidentiality and integrity of data available in the user\u0027s browser context. The first affected version is 2024.4.1112; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111.\u003c/p\u003e"
            }
          ],
          "value": "In Progress Kendo UI for jQuery, Spreadsheet sheet names are inserted into the SheetsBar menu button\u0027s data-sheet-name attribute without encoding. An attacker who can influence a sheet name can inject an event-handler attribute and execute JavaScript when a user hovers over the menu button. Successful exploitation may compromise the confidentiality and integrity of data available in the user\u0027s browser context. The first affected version is 2024.4.1112; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-63",
          "descriptions": [
            {
              "lang": "en",
              "value": "Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-12T17:02:11.806Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-kendo-spreadsheet-sheet-names-xss-cve-2026-124696"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Cross-Site Scripting in Kendo UI for jQuery Spreadsheet Sheet Names",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-124696",
    "datePublished": "2026-11-12T17:02:11.806Z",
    "dateReserved": "2026-11-09T10:41:43.932Z",
    "dateUpdated": "2026-11-12T17:02:11.806Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124695 (GCVE-0-2026-124695)

Vulnerability from nvd – Published: 2026-11-12 16:52 – Updated: 2026-11-12 16:52

Title

Cross-Site Scripting in Kendo UI for jQuery Form Item Hints

Summary

In Progress Kendo UI for jQuery Form, the items[].hint option is documented as a string but is rendered as HTML. An attacker who can influence a Form item's hint can cause attacker-controlled markup to execute as JavaScript when a user views the rendered form. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected version is 2020.2.513; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 79/100 over 205 records in the last 180 days details

References

1 reference

URL	Tags
https://www.telerik.com/kendo-jquery-ui/documenta…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress Software	Kendo UI for jQuery	Affected: 2020.2.513 , ≤ 2026.3.1015 (custom)

Credits

Abhishek Nandkumar Bhaskar (Abhi-Hackz)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Kendo UI for jQuery",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThanOrEqual": "2026.3.1015",
              "status": "affected",
              "version": "2020.2.513",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abhishek Nandkumar Bhaskar (Abhi-Hackz)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Progress Kendo UI for jQuery Form, the items[].hint option is documented as a string but is rendered as HTML. An attacker who can influence a Form item\u0027s hint can cause attacker-controlled markup to execute as JavaScript when a user views the rendered form. Successful exploitation may compromise the confidentiality and integrity of data available in the user\u0027s browser context. The first affected version is 2020.2.513; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111.\u003c/p\u003e"
            }
          ],
          "value": "In Progress Kendo UI for jQuery Form, the items[].hint option is documented as a string but is rendered as HTML. An attacker who can influence a Form item\u0027s hint can cause attacker-controlled markup to execute as JavaScript when a user views the rendered form. Successful exploitation may compromise the confidentiality and integrity of data available in the user\u0027s browser context. The first affected version is 2020.2.513; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-63",
          "descriptions": [
            {
              "lang": "en",
              "value": "Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-12T16:52:14.648Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-kendo-form-item-hint-xss-cve-2026-124695"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Cross-Site Scripting in Kendo UI for jQuery Form Item Hints",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-124695",
    "datePublished": "2026-11-12T16:52:14.648Z",
    "dateReserved": "2026-11-09T10:41:42.890Z",
    "dateUpdated": "2026-11-12T16:52:14.648Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124691 (GCVE-0-2026-124691)

Vulnerability from nvd – Published: 2026-11-12 16:42 – Updated: 2026-11-12 16:47

Title

Cross-Site Scripting in Kendo UI for jQuery Gantt Parent Dropdown

Summary

In Progress Kendo UI for jQuery Gantt, the task editor's Parent dropdown renders task titles as HTML. An attacker who can influence a task title shown in the dropdown can cause attacker-controlled markup to execute as JavaScript when a user opens or interacts with the task editor. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected version is 2020.3.915; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 79/100 over 205 records in the last 180 days details

References

1 reference

URL	Tags
https://www.telerik.com/kendo-jquery-ui/documenta…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress Software	Kendo UI for jQuery	Affected: 2020.3.915 , ≤ 2026.3.1015 (custom)

Credits

Abhishek Nandkumar Bhaskar (Abhi-Hackz)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Kendo UI for jQuery",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThanOrEqual": "2026.3.1015",
              "status": "affected",
              "version": "2020.3.915",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abhishek Nandkumar Bhaskar (Abhi-Hackz)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Progress Kendo UI for jQuery Gantt, the task editor\u0027s Parent dropdown renders task titles as HTML. An attacker who can influence a task title shown in the dropdown can cause attacker-controlled markup to execute as JavaScript when a user opens or interacts with the task editor. Successful exploitation may compromise the confidentiality and integrity of data available in the user\u0027s browser context. The first affected version is 2020.3.915; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111.\u003c/p\u003e"
            }
          ],
          "value": "In Progress Kendo UI for jQuery Gantt, the task editor\u0027s Parent dropdown renders task titles as HTML. An attacker who can influence a task title shown in the dropdown can cause attacker-controlled markup to execute as JavaScript when a user opens or interacts with the task editor. Successful exploitation may compromise the confidentiality and integrity of data available in the user\u0027s browser context. The first affected version is 2020.3.915; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-63",
          "descriptions": [
            {
              "lang": "en",
              "value": "Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-12T16:47:05.093Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-kendo-gantt-parent-dropdown-xss-cve-2026-124691"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Cross-Site Scripting in Kendo UI for jQuery Gantt Parent Dropdown",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-124691",
    "datePublished": "2026-11-12T16:42:30.326Z",
    "dateReserved": "2026-11-09T10:41:42.890Z",
    "dateUpdated": "2026-11-12T16:47:05.093Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124694 (GCVE-0-2026-124694)

Vulnerability from nvd – Published: 2026-11-11 16:57 – Updated: 2026-11-11 16:57

Title

Cross-Site Scripting in Kendo UI for jQuery PropertyGrid Values and Descriptions

Summary

In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PropertyGrid does not encode bound property values and items[].description in its default configuration. An attacker who can influence either value can cause JavaScript to execute when a user views the grid. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected release has not been established.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 79/100 over 205 records in the last 180 days details

References

1 reference

URL	Tags
https://www.telerik.com/kendo-jquery-ui/documenta…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress Software	Kendo UI for jQuery	Affected: 2026.3.1015 , < 2026.4.1110 (custom) Unaffected: 2026.4.1110

Credits

Abhishek Nandkumar Bhaskar (Abhi-Hackz)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Kendo UI for jQuery",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThan": "2026.4.1110",
              "status": "affected",
              "version": "2026.3.1015",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2026.4.1110"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abhishek Nandkumar Bhaskar (Abhi-Hackz)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PropertyGrid does not encode bound property values and items[].description in its default configuration. An attacker who can influence either value can cause JavaScript to execute when a user views the grid. Successful exploitation may compromise the confidentiality and integrity of data available in the user\u0027s browser context. The first affected release has not been established.\u003c/p\u003e"
            }
          ],
          "value": "In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PropertyGrid does not encode bound property values and items[].description in its default configuration. An attacker who can influence either value can cause JavaScript to execute when a user views the grid. Successful exploitation may compromise the confidentiality and integrity of data available in the user\u0027s browser context. The first affected release has not been established."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T16:57:45.440Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-kendo-propertygrid-bound-values-description-xss-cve-2026-124694"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Cross-Site Scripting in Kendo UI for jQuery PropertyGrid Values and Descriptions",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-124694",
    "datePublished": "2026-11-11T16:57:45.440Z",
    "dateReserved": "2026-11-09T10:41:42.890Z",
    "dateUpdated": "2026-11-11T16:57:45.440Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124693 (GCVE-0-2026-124693)

Vulnerability from nvd – Published: 2026-11-11 16:54 – Updated: 2026-11-11 16:54

Title

Cross-Site Scripting in Kendo UI for jQuery PivotGrid Axis Chips

Summary

In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PivotGrid and PivotConfigurator axis field names are passed to a chip template without appropriate encoding. An attacker who can influence an axis field name can cause JavaScript to execute when a user views the rendered chip. The field name can be interpreted as HTML in both attribute and element contexts. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected release has not been established.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 79/100 over 205 records in the last 180 days details

References

1 reference

URL	Tags
https://www.telerik.com/kendo-jquery-ui/documenta…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress Software	Kendo UI for jQuery	Affected: 2026.3.1015 , < 2026.4.1110 (custom) Unaffected: 2026.4.1110

Credits

Abhishek Nandkumar Bhaskar (Abhi-Hackz)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Kendo UI for jQuery",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThan": "2026.4.1110",
              "status": "affected",
              "version": "2026.3.1015",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2026.4.1110"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abhishek Nandkumar Bhaskar (Abhi-Hackz)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PivotGrid and PivotConfigurator axis field names are passed to a chip template without appropriate encoding. An attacker who can influence an axis field name can cause JavaScript to execute when a user views the rendered chip. The field name can be interpreted as HTML in both attribute and element contexts. Successful exploitation may compromise the confidentiality and integrity of data available in the user\u0027s browser context. The first affected release has not been established.\u003c/p\u003e"
            }
          ],
          "value": "In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PivotGrid and PivotConfigurator axis field names are passed to a chip template without appropriate encoding. An attacker who can influence an axis field name can cause JavaScript to execute when a user views the rendered chip. The field name can be interpreted as HTML in both attribute and element contexts. Successful exploitation may compromise the confidentiality and integrity of data available in the user\u0027s browser context. The first affected release has not been established."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T16:54:21.803Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-kendo-pivotgrid-pivotconfigurator-axis-chip-xss-cve-2026-124693"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Cross-Site Scripting in Kendo UI for jQuery PivotGrid Axis Chips",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-124693",
    "datePublished": "2026-11-11T16:54:21.803Z",
    "dateReserved": "2026-11-09T10:41:42.890Z",
    "dateUpdated": "2026-11-11T16:54:21.803Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124692 (GCVE-0-2026-124692)

Vulnerability from nvd – Published: 2026-11-11 16:52 – Updated: 2026-11-11 16:52

Title

Cross-Site Scripting in Kendo UI for jQuery Grid and TreeList Column Reordering

Summary

In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, the Grid and TreeList column-reorder drag clue reparses header text as HTML. An attacker who can influence a column field or title used by an affected application can cause JavaScript to execute when a user drags a column header while column reordering is enabled. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected release has not been established.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 79/100 over 205 records in the last 180 days details

References

1 reference

URL	Tags
https://www.telerik.com/kendo-jquery-ui/documenta…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress Software	Kendo UI for jQuery	Affected: 2026.3.1015 , < 2026.4.1110 (custom) Unaffected: 2026.4.1110

Credits

Abhishek Nandkumar Bhaskar (Abhi-Hackz)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Kendo UI for jQuery",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThan": "2026.4.1110",
              "status": "affected",
              "version": "2026.3.1015",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2026.4.1110"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abhishek Nandkumar Bhaskar (Abhi-Hackz)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, the Grid and TreeList column-reorder drag clue reparses header text as HTML. An attacker who can influence a column field or title used by an affected application can cause JavaScript to execute when a user drags a column header while column reordering is enabled. Successful exploitation may compromise the confidentiality and integrity of data available in the user\u0027s browser context. The first affected release has not been established.\u003c/p\u003e"
            }
          ],
          "value": "In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, the Grid and TreeList column-reorder drag clue reparses header text as HTML. An attacker who can influence a column field or title used by an affected application can cause JavaScript to execute when a user drags a column header while column reordering is enabled. Successful exploitation may compromise the confidentiality and integrity of data available in the user\u0027s browser context. The first affected release has not been established."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T16:52:26.328Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-kendo-grid-treelist-column-reorder-drag-clue-xss-cve-2026-124692"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Cross-Site Scripting in Kendo UI for jQuery Grid and TreeList Column Reordering",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-124692",
    "datePublished": "2026-11-11T16:52:26.328Z",
    "dateReserved": "2026-11-09T10:41:42.890Z",
    "dateUpdated": "2026-11-11T16:52:26.328Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124690 (GCVE-0-2026-124690)

Vulnerability from nvd – Published: 2026-11-11 16:50 – Updated: 2026-11-11 16:50

Title

Cross-Site Scripting During Kendo UI for jQuery Custom SVG Icon Sanitization

Summary

In Progress Kendo UI for jQuery, sanitizeSvgContent() parses custom icon markup into a live DOM before filtering it. An attacker who can influence custom icon content can cause JavaScript to execute during icon creation, before an unsafe element is removed. The issue was reported in version 2026.3.1015; the first affected release has not been established. The issue is fixed in version 2026.4.1110.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 79/100 over 205 records in the last 180 days details

References

1 reference

URL	Tags
https://www.telerik.com/kendo-jquery-ui/documenta…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress Software	Kendo UI for jQuery	Affected: 2026.3.1015 , < 2026.4.1110 (custom) Unaffected: 2026.4.1110

Credits

Abhishek Nandkumar Bhaskar (Abhi-Hackz)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Kendo UI for jQuery",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThan": "2026.4.1110",
              "status": "affected",
              "version": "2026.3.1015",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2026.4.1110"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abhishek Nandkumar Bhaskar (Abhi-Hackz)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Progress Kendo UI for jQuery, sanitizeSvgContent() parses custom icon markup into a live DOM before filtering it. An attacker who can influence custom icon content can cause JavaScript to execute during icon creation, before an unsafe element is removed. The issue was reported in version 2026.3.1015; the first affected release has not been established. The issue is fixed in version 2026.4.1110.\u003c/p\u003e"
            }
          ],
          "value": "In Progress Kendo UI for jQuery, sanitizeSvgContent() parses custom icon markup into a live DOM before filtering it. An attacker who can influence custom icon content can cause JavaScript to execute during icon creation, before an unsafe element is removed. The issue was reported in version 2026.3.1015; the first affected release has not been established. The issue is fixed in version 2026.4.1110."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T16:50:59.752Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-kendo-svg-icon-sanitizer-xss-cve-2026-124690"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Cross-Site Scripting During Kendo UI for jQuery Custom SVG Icon Sanitization",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-124690",
    "datePublished": "2026-11-11T16:50:59.752Z",
    "dateReserved": "2026-11-09T10:41:42.889Z",
    "dateUpdated": "2026-11-11T16:50:59.752Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124689 (GCVE-0-2026-124689)

Vulnerability from nvd – Published: 2026-11-11 16:48 – Updated: 2026-11-11 16:48

Title

Cross-Site Scripting in Kendo UI for jQuery ActionSheet Header Labels

Summary

In Progress Kendo UI for jQuery versions 2026.3.1014 up to, but not including, 2026.4.1110, ActionSheet does not encode title, subtitle, and header button label values before rendering them. An attacker who can influence these values can inject markup that executes as JavaScript when a user opens the ActionSheet. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The report identifies version 2026.3.1014; the first affected release has not been established.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 79/100 over 205 records in the last 180 days details

References

1 reference

URL	Tags
https://www.telerik.com/kendo-jquery-ui/documenta…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress Software	Kendo UI for jQuery	Affected: 2026.3.1014 , < 2026.4.1110 (custom) Unaffected: 2026.4.1110

Credits

Abhishek Nandkumar Bhaskar (Abhi-Hackz)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Kendo UI for jQuery",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThan": "2026.4.1110",
              "status": "affected",
              "version": "2026.3.1014",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2026.4.1110"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abhishek Nandkumar Bhaskar (Abhi-Hackz)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Progress Kendo UI for jQuery versions 2026.3.1014 up to, but not including, 2026.4.1110, ActionSheet does not encode title, subtitle, and header button label values before rendering them. An attacker who can influence these values can inject markup that executes as JavaScript when a user opens the ActionSheet. Successful exploitation may compromise the confidentiality and integrity of data available in the user\u0027s browser context. The report identifies version 2026.3.1014; the first affected release has not been established.\u003c/p\u003e"
            }
          ],
          "value": "In Progress Kendo UI for jQuery versions 2026.3.1014 up to, but not including, 2026.4.1110, ActionSheet does not encode title, subtitle, and header button label values before rendering them. An attacker who can influence these values can inject markup that executes as JavaScript when a user opens the ActionSheet. Successful exploitation may compromise the confidentiality and integrity of data available in the user\u0027s browser context. The report identifies version 2026.3.1014; the first affected release has not been established."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-63",
          "descriptions": [
            {
              "lang": "en",
              "value": "Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T16:48:21.531Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-kendo-actionsheet-header-xss-cve-2026-124689"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Cross-Site Scripting in Kendo UI for jQuery ActionSheet Header Labels",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-124689",
    "datePublished": "2026-11-11T16:48:21.531Z",
    "dateReserved": "2026-11-09T10:41:42.889Z",
    "dateUpdated": "2026-11-11T16:48:21.531Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124688 (GCVE-0-2026-124688)

Vulnerability from nvd – Published: 2026-11-11 16:44 – Updated: 2026-11-11 16:44

Title

Cross-Site Scripting via the spriteCssClass Field in Kendo UI for jQuery

Summary

In Progress® Kendo® UI for jQuery prior to 2026.4.1111 the TabStrip, PanelBar, and Menu widgets support mapping a dataSource field to `spriteCssClass`. If an attacker can control the mapped data, they can break out of the attribute and inject markup, including event-handler attributes. The resulting JavaScript executes in the application's origin when a victim loads a page that renders the affected widget, allowing access to data and actions available in the victim's authenticated session.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CWE

CWE-80 - Improper neutralization of Script-Related HTML tags in a web page (basic XSS)

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 79/100 over 205 records in the last 180 days details

References

1 reference

URL	Tags
https://www.telerik.com/kendo-jquery-ui/documenta…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress Software	Kendo UI for jQuery	Affected: 2012.1.322 , < 2026.4.1111 (custom)

Credits

Suryansh Narang

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Kendo UI for jQuery",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThan": "2026.4.1111",
              "status": "affected",
              "version": "2012.1.322",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Suryansh Narang"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Progress\u00ae Kendo\u00ae UI for jQuery prior to\u0026nbsp;\u003cspan\u003e2026.4.1111 \u003c/span\u003ethe TabStrip, PanelBar, and Menu widgets support mapping a dataSource field to `spriteCssClass`. If an attacker can control the mapped data, they can break out of the attribute and inject markup, including event-handler attributes. The resulting JavaScript executes in the application\u0027s origin when a victim loads a page that renders the affected widget, allowing access to data and actions available in the victim\u0027s authenticated session.\u003c/p\u003e"
            }
          ],
          "value": "In Progress\u00ae Kendo\u00ae UI for jQuery prior to\u00a02026.4.1111 the TabStrip, PanelBar, and Menu widgets support mapping a dataSource field to `spriteCssClass`. If an attacker can control the mapped data, they can break out of the attribute and inject markup, including event-handler attributes. The resulting JavaScript executes in the application\u0027s origin when a victim loads a page that renders the affected widget, allowing access to data and actions available in the victim\u0027s authenticated session."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "XSS Targeting Non-Script Elements"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-80",
              "description": "CWE-80 Improper neutralization of Script-Related HTML tags in a web page (basic XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T16:44:32.121Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-tabstrip-panelbar-menu-spritecssclass-xss-cve-2026-124688"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Cross-Site Scripting via the spriteCssClass Field in Kendo UI for jQuery",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-124688",
    "datePublished": "2026-11-11T16:44:32.121Z",
    "dateReserved": "2026-11-09T10:41:42.889Z",
    "dateUpdated": "2026-11-11T16:44:32.121Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124687 (GCVE-0-2026-124687)

Vulnerability from nvd – Published: 2026-11-11 16:25 – Updated: 2026-11-11 16:25

Title

Cross-Site Scripting in DropDownButton and SplitButton Items in Kendo UI for jQuery

Summary

In Progress® Kendo® UI for jQuery versions from 2022.2.621 prior to 2026.4.1111 the DropDownButton and SplitButton allow markup injection through the `id` and `target` attributes. An attacker who can influence these item values can break out of the attributes and inject markup, including event handlers. The issue is fixed in 2026.4.1111.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CWE

CWE-80 - Improper neutralization of Script-Related HTML tags in a web page (basic XSS)

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 79/100 over 205 records in the last 180 days details

References

1 reference

URL	Tags
https://www.telerik.com/kendo-jquery-ui/documenta…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress Software	Kendo UI for jQuery	Affected: 2022.2.621 , < 2026.4.1111 (custom)

Credits

Abhishek Nandkumar Bhaskar (Abhi-Hackz)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Kendo UI for jQuery",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThan": "2026.4.1111",
              "status": "affected",
              "version": "2022.2.621",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abhishek Nandkumar Bhaskar (Abhi-Hackz)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Progress\u00ae Kendo\u00ae UI for jQuery versions from 2022.2.621 prior to\u0026nbsp;\u003cspan\u003e2026.4.1111\u003c/span\u003e\u0026nbsp;the DropDownButton and SplitButton allow markup injection through the `id` and `target` attributes. An attacker who can influence these item values can break out of the attributes and inject markup, including event handlers. The issue is fixed in\u0026nbsp;\u003cspan\u003e2026.4.1111\u003c/span\u003e.\u003c/p\u003e"
            }
          ],
          "value": "In Progress\u00ae Kendo\u00ae UI for jQuery versions from 2022.2.621 prior to\u00a02026.4.1111\u00a0the DropDownButton and SplitButton allow markup injection through the `id` and `target` attributes. An attacker who can influence these item values can break out of the attributes and inject markup, including event handlers. The issue is fixed in\u00a02026.4.1111."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "XSS Targeting Non-Script Elements"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-80",
              "description": "CWE-80 Improper neutralization of Script-Related HTML tags in a web page (basic XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T16:25:03.748Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-dropdownbutton-splitbutton-items-attribute-xss-cve-2026-124687"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Cross-Site Scripting in DropDownButton and SplitButton Items in Kendo UI for jQuery",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-124687",
    "datePublished": "2026-11-11T16:25:03.748Z",
    "dateReserved": "2026-11-09T10:41:42.889Z",
    "dateUpdated": "2026-11-11T16:25:03.748Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124686 (GCVE-0-2026-124686)

Vulnerability from nvd – Published: 2026-11-11 15:27 – Updated: 2026-11-11 15:27

Title

JavaScript Code Injection through kendo.init() in Kendo UI for jQuery

Summary

In Progress® Kendo® UI for jQuery versions prior to 2026.4.1111, kendo.init() compiles data-* attribute values with new Function when an invalid JSON object is supplied. An attacker with low privileges who can control these attribute values can inject JavaScript that executes during declarative widget initialization when a user loads or interacts with an affected page. Successful exploitation can compromise the confidentiality and integrity of data accessible in the user's browser context. The issue was reported in version 2022.3.1109; the first affected release has not been established.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWE

CWE-95 - Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 79/100 over 205 records in the last 180 days details

References

1 reference

URL	Tags
https://www.telerik.com/kendo-jquery-ui/documenta…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress Software	Kendo UI for jQuery	Affected: 2022.3.1109 , < 2026.4.1111 (custom) Unaffected: 2026.4.1111

Credits

Abhishek Nandkumar Bhaskar (Abhi-Hackz)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Kendo UI for jQuery",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThan": "2026.4.1111",
              "status": "affected",
              "version": "2022.3.1109",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2026.4.1111"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abhishek Nandkumar Bhaskar (Abhi-Hackz)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Progress\u00ae Kendo\u00ae UI for jQuery versions prior to 2026.4.1111, kendo.init() compiles data-* attribute values with new Function when an invalid JSON object is supplied. An attacker with low privileges who can control these attribute values can inject JavaScript that executes during declarative widget initialization when a user loads or interacts with an affected page. Successful exploitation can compromise the confidentiality and integrity of data accessible in the user\u0027s browser context. The issue was reported in version 2022.3.1109; the first affected release has not been established.\u003c/p\u003e"
            }
          ],
          "value": "In Progress\u00ae Kendo\u00ae UI for jQuery versions prior to 2026.4.1111, kendo.init() compiles data-* attribute values with new Function when an invalid JSON object is supplied. An attacker with low privileges who can control these attribute values can inject JavaScript that executes during declarative widget initialization when a user loads or interacts with an affected page. Successful exploitation can compromise the confidentiality and integrity of data accessible in the user\u0027s browser context. The issue was reported in version 2022.3.1109; the first affected release has not been established."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Code Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-95",
              "description": "CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T15:27:32.762Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-kendo-init-code-injection-cve-2026-124686"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "JavaScript Code Injection through kendo.init() in Kendo UI for jQuery",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-124686",
    "datePublished": "2026-11-11T15:27:32.762Z",
    "dateReserved": "2026-11-09T10:41:42.889Z",
    "dateUpdated": "2026-11-11T15:27:32.762Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108116 (GCVE-0-2026-108116)

Vulnerability from nvd – Published: 2026-10-15 14:12 – Updated: 2026-10-15 18:11

Title

MDX and SOAP Injection in Kendo UI for jQuery

Summary

In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 18:11 UTC

CWE

CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 79/100 over 205 records in the last 180 days details

References

1 reference

URL	Tags
https://www.telerik.com/kendo-jquery-ui/documenta…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress Software	Kendo UI for jQuery	Affected: 2014.2.716 , < 2026.3.1015 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-108116",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T18:11:36.045830Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T18:11:50.463Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Kendo UI for jQuery",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThan": "2026.3.1015",
              "status": "affected",
              "version": "2014.2.716",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection.\u003c/p\u003e"
            }
          ],
          "value": "In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T14:12:52.017Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-pivotgrid-mdx-soap-injection-cve-2026-108116"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "MDX and SOAP Injection in Kendo UI for jQuery",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-108116",
    "datePublished": "2026-10-15T14:12:52.017Z",
    "dateReserved": "2026-10-09T13:53:55.040Z",
    "dateUpdated": "2026-10-15T18:11:50.463Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-106153 (GCVE-0-2026-106153)

Vulnerability from nvd – Published: 2026-10-15 14:12 – Updated: 2026-10-15 18:24

Title

Cross-site Scripting (XSS) in Kendo UI for jQuery Calendar and MultiViewCalendar

Summary

In Progress® Kendo® UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar month content templates render data.url and data.title without proper URL sanitization and HTML attribute encoding. An attacker with low privileges who can control the URL option or culture-derived title values can supply a JavaScript URL or inject event-handler attributes. When a user interacts with an affected calendar, JavaScript can execute in the user's browser context and compromise the confidentiality and integrity of accessible data.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 18:24 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 79/100 over 205 records in the last 180 days details

References

1 reference

URL	Tags
https://www.telerik.com/kendo-jquery-ui/documenta…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress Software	Kendo UI for jQuery	Affected: 2011.3.1007 , < 2026.3.1015 (custom)

Credits

Abhishek Nandkumar Bhaskar (Abhi-Hackz)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-106153",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T18:24:38.962227Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T18:24:48.793Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Kendo UI for jQuery",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThan": "2026.3.1015",
              "status": "affected",
              "version": "2011.3.1007",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abhishek Nandkumar Bhaskar (Abhi-Hackz)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Progress\u00ae Kendo\u00ae UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar month content templates render data.url and data.title without proper URL sanitization and HTML attribute encoding. An attacker with low privileges who can control the URL option or culture-derived title values can supply a JavaScript URL or inject event-handler attributes. When a user interacts with an affected calendar, JavaScript can execute in the user\u0027s browser context and compromise the confidentiality and integrity of accessible data.\u003c/p\u003e"
            }
          ],
          "value": "In Progress\u00ae Kendo\u00ae UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar month content templates render data.url and data.title without proper URL sanitization and HTML attribute encoding. An attacker with low privileges who can control the URL option or culture-derived title values can supply a JavaScript URL or inject event-handler attributes. When a user interacts with an affected calendar, JavaScript can execute in the user\u0027s browser context and compromise the confidentiality and integrity of accessible data."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "XSS Targeting Non-Script Elements"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T14:12:05.941Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-calendar-month-template-xss-cve-2026-106153"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Cross-site Scripting (XSS) in Kendo UI for jQuery Calendar and MultiViewCalendar",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-106153",
    "datePublished": "2026-10-15T14:12:05.941Z",
    "dateReserved": "2026-10-06T15:51:11.738Z",
    "dateUpdated": "2026-10-15T18:24:48.793Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-106151 (GCVE-0-2026-106151)

Vulnerability from nvd – Published: 2026-10-15 14:11 – Updated: 2026-10-15 18:12

Title

Cross-Site Scripting in Validator Validation Messages in Kendo UI for jQuery

Summary

In Progress® Kendo® UI for jQuery versions starting with 2012.2.710 and prior to 2026.3.1015, the Validator decodes validation messages from data-msg-* attributes and parses the resulting text as HTML. An attacker who can modify a validation message can cause HTML that was correctly escaped in the page attribute to become active markup, including event handlers, when the user triggers validation. Successful exploitation can execute JavaScript in a user's browser and compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 18:12 UTC

CWE

CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 79/100 over 205 records in the last 180 days details

References

1 reference

URL	Tags
https://www.telerik.com/kendo-jquery-ui/documenta…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress Software	Kendo UI for jQuery	Affected: 2012.2.710 , < 2026.3.1015 (custom)

Credits

Abhishek Nandkumar Bhaskar (Abhi-Hackz)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-106151",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T18:12:05.879493Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T18:12:49.751Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Kendo UI for jQuery",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThan": "2026.3.1015",
              "status": "affected",
              "version": "2012.2.710",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abhishek Nandkumar Bhaskar (Abhi-Hackz)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Progress\u00ae Kendo\u00ae UI for jQuery versions starting with 2012.2.710 and prior to 2026.3.1015, the Validator decodes validation messages from data-msg-* attributes and parses the resulting text as HTML. An attacker who can modify a validation message can cause HTML that was correctly escaped in the page attribute to become active markup, including event handlers, when the user triggers validation. Successful exploitation can execute JavaScript in a user\u0027s browser and compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015.\u003c/p\u003e"
            }
          ],
          "value": "In Progress\u00ae Kendo\u00ae UI for jQuery versions starting with 2012.2.710 and prior to 2026.3.1015, the Validator decodes validation messages from data-msg-* attributes and parses the resulting text as HTML. An attacker who can modify a validation message can cause HTML that was correctly escaped in the page attribute to become active markup, including event handlers, when the user triggers validation. Successful exploitation can execute JavaScript in a user\u0027s browser and compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "XSS Targeting Non-Script Elements"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-80",
              "description": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T14:11:08.537Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-validator-message-xss-cve-2026-106151"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Cross-Site Scripting in Validator Validation Messages in Kendo UI for jQuery",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-106151",
    "datePublished": "2026-10-15T14:11:08.537Z",
    "dateReserved": "2026-10-06T15:51:11.738Z",
    "dateUpdated": "2026-10-15T18:12:49.751Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-106150 (GCVE-0-2026-106150)

Vulnerability from nvd – Published: 2026-10-15 14:09 – Updated: 2026-10-15 18:13

Title

Cross-site Scripting (XSS) in Kendo UI for jQuery Splitter, Window, and Tooltip

Summary

In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the Splitter and Window components starting with version 2011.2.804 and the Tooltip component starting with version 2013.1.319 construct iframe markup without properly sanitizing URL values or encoding the Window iframe title. An attacker with low privileges who can control these values can inject HTML attributes, including JavaScript event handlers, through an apostrophe in an iframe URL or a crafted title. When a user interacts with the affected component, injected JavaScript can execute in the user's browser context, compromising the confidentiality and integrity of accessible data.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 18:13 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 79/100 over 205 records in the last 180 days details

References

1 reference

URL	Tags
https://www.telerik.com/kendo-jquery-ui/documenta…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress Software	Kendo UI for jQuery	Affected: 2013.1.319 , < 2026.3.1015 (custom) Affected: 2011.2.804 , < 2026.3.1015 (custom)

Credits

Abhishek Nandkumar Bhaskar (Abhi-Hackz)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-106150",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T18:13:07.711196Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T18:13:16.731Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Kendo UI for jQuery",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThan": "2026.3.1015",
              "status": "affected",
              "version": "2013.1.319",
              "versionType": "custom"
            },
            {
              "lessThan": "2026.3.1015",
              "status": "affected",
              "version": "2011.2.804",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abhishek Nandkumar Bhaskar (Abhi-Hackz)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Progress\u00ae Kendo\u00ae UI for jQuery prior to 2026.3.1015, the Splitter and Window components starting with version 2011.2.804 and the Tooltip component starting with version 2013.1.319 construct iframe markup without properly sanitizing URL values or encoding the Window iframe title. An attacker with low privileges who can control these values can inject HTML attributes, including JavaScript event handlers, through an apostrophe in an iframe URL or a crafted title. When a user interacts with the affected component, injected JavaScript can execute in the user\u0027s browser context, compromising the confidentiality and integrity of accessible data.\u003c/p\u003e"
            }
          ],
          "value": "In Progress\u00ae Kendo\u00ae UI for jQuery prior to 2026.3.1015, the Splitter and Window components starting with version 2011.2.804 and the Tooltip component starting with version 2013.1.319 construct iframe markup without properly sanitizing URL values or encoding the Window iframe title. An attacker with low privileges who can control these values can inject HTML attributes, including JavaScript event handlers, through an apostrophe in an iframe URL or a crafted title. When a user interacts with the affected component, injected JavaScript can execute in the user\u0027s browser context, compromising the confidentiality and integrity of accessible data."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "XSS Targeting Non-Script Elements"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T14:09:50.330Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-cross-site-scripting-splitter-window-tooltip-cve-2026-106150"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Cross-site Scripting (XSS) in Kendo UI for jQuery Splitter, Window, and Tooltip",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-106150",
    "datePublished": "2026-10-15T14:09:50.330Z",
    "dateReserved": "2026-10-06T15:51:11.738Z",
    "dateUpdated": "2026-10-15T18:13:16.731Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124698 (GCVE-0-2026-124698)

Vulnerability from cvelistv5 – Published: 2026-11-12 17:09 – Updated: 2026-11-12 17:09

Title

Cross-Site Scripting in Kendo UI for jQuery Chart Shared Tooltip

Summary

In Progress Kendo UI for jQuery, the Chart default tooltip renders point values as raw HTML. An attacker who can influence a string point value can inject markup that executes as JavaScript when a user hovers over the point. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. Version 2016.2.607 or earlier may be affected, but earlier releases have not been verified. The latest vulnerable version is 2026.3.1015; the issue is fixed in version 2026.4.1111.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 79/100 over 205 records in the last 180 days details

References

1 reference

URL	Tags
https://www.telerik.com/kendo-jquery-ui/documenta…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress Software	Kendo UI for jQuery	Affected: 2016.2.607 , ≤ 2026.3.1015 (custom)

Credits

Abhishek Nandkumar Bhaskar (Abhi-Hackz)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Kendo UI for jQuery",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThanOrEqual": "2026.3.1015",
              "status": "affected",
              "version": "2016.2.607",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abhishek Nandkumar Bhaskar (Abhi-Hackz)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Progress Kendo UI for jQuery, the Chart default tooltip renders point values as raw HTML. An attacker who can influence a string point value can inject markup that executes as JavaScript when a user hovers over the point. Successful exploitation may compromise the confidentiality and integrity of data available in the user\u0027s browser context. Version 2016.2.607 or earlier may be affected, but earlier releases have not been verified. The latest vulnerable version is 2026.3.1015; the issue is fixed in version 2026.4.1111.\u003c/p\u003e"
            }
          ],
          "value": "In Progress Kendo UI for jQuery, the Chart default tooltip renders point values as raw HTML. An attacker who can influence a string point value can inject markup that executes as JavaScript when a user hovers over the point. Successful exploitation may compromise the confidentiality and integrity of data available in the user\u0027s browser context. Version 2016.2.607 or earlier may be affected, but earlier releases have not been verified. The latest vulnerable version is 2026.3.1015; the issue is fixed in version 2026.4.1111."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-63",
          "descriptions": [
            {
              "lang": "en",
              "value": "Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-12T17:09:34.698Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-kendo-chart-tooltip-point-value-xss-cve-2026-124698"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Cross-Site Scripting in Kendo UI for jQuery Chart Shared Tooltip",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-124698",
    "datePublished": "2026-11-12T17:09:34.698Z",
    "dateReserved": "2026-11-09T10:41:43.933Z",
    "dateUpdated": "2026-11-12T17:09:34.698Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124697 (GCVE-0-2026-124697)

Vulnerability from cvelistv5 – Published: 2026-11-12 17:06 – Updated: 2026-11-12 17:06

Title

Cross-Site Scripting in Kendo UI for jQuery Chart Shared Tooltip

Summary

In Progress Kendo UI for jQuery, Chart shared-tooltip rendering treats bound category and series-name values as raw HTML. An attacker who can influence values consumed by an affected Chart can inject markup that executes as JavaScript when a user displays the shared tooltip. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. Version 2016.2.607 or earlier may be affected, but earlier releases have not been verified. The latest vulnerable version is 2026.3.1015; the issue is fixed in version 2026.4.1111.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 79/100 over 205 records in the last 180 days details

References

1 reference

URL	Tags
https://www.telerik.com/kendo-jquery-ui/documenta…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress Software	Kendo UI for jQuery	Affected: 2016.2.607 , ≤ 2026.3.1015 (custom)

Credits

Abhishek Nandkumar Bhaskar (Abhi-Hackz)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Kendo UI for jQuery",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThanOrEqual": "2026.3.1015",
              "status": "affected",
              "version": "2016.2.607",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abhishek Nandkumar Bhaskar (Abhi-Hackz)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Progress Kendo UI for jQuery, Chart shared-tooltip rendering treats bound category and series-name values as raw HTML. An attacker who can influence values consumed by an affected Chart can inject markup that executes as JavaScript when a user displays the shared tooltip. Successful exploitation may compromise the confidentiality and integrity of data available in the user\u0027s browser context. Version 2016.2.607 or earlier may be affected, but earlier releases have not been verified. The latest vulnerable version is 2026.3.1015; the issue is fixed in version 2026.4.1111.\u003c/p\u003e"
            }
          ],
          "value": "In Progress Kendo UI for jQuery, Chart shared-tooltip rendering treats bound category and series-name values as raw HTML. An attacker who can influence values consumed by an affected Chart can inject markup that executes as JavaScript when a user displays the shared tooltip. Successful exploitation may compromise the confidentiality and integrity of data available in the user\u0027s browser context. Version 2016.2.607 or earlier may be affected, but earlier releases have not been verified. The latest vulnerable version is 2026.3.1015; the issue is fixed in version 2026.4.1111."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-63",
          "descriptions": [
            {
              "lang": "en",
              "value": "Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-12T17:06:27.602Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-kendo-chart-shared-tooltip-xss-cve-2026-124697"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Cross-Site Scripting in Kendo UI for jQuery Chart Shared Tooltip",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-124697",
    "datePublished": "2026-11-12T17:06:27.602Z",
    "dateReserved": "2026-11-09T10:41:43.933Z",
    "dateUpdated": "2026-11-12T17:06:27.602Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124696 (GCVE-0-2026-124696)

Vulnerability from cvelistv5 – Published: 2026-11-12 17:02 – Updated: 2026-11-12 17:02

Title

Cross-Site Scripting in Kendo UI for jQuery Spreadsheet Sheet Names

Summary

In Progress Kendo UI for jQuery, Spreadsheet sheet names are inserted into the SheetsBar menu button's data-sheet-name attribute without encoding. An attacker who can influence a sheet name can inject an event-handler attribute and execute JavaScript when a user hovers over the menu button. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected version is 2024.4.1112; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 79/100 over 205 records in the last 180 days details

References

1 reference

URL	Tags
https://www.telerik.com/kendo-jquery-ui/documenta…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress Software	Kendo UI for jQuery	Affected: 2024.4.1112 , ≤ 2026.3.1015 (custom)

Credits

Abhishek Nandkumar Bhaskar (Abhi-Hackz)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Kendo UI for jQuery",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThanOrEqual": "2026.3.1015",
              "status": "affected",
              "version": "2024.4.1112",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abhishek Nandkumar Bhaskar (Abhi-Hackz)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Progress Kendo UI for jQuery, Spreadsheet sheet names are inserted into the SheetsBar menu button\u0027s data-sheet-name attribute without encoding. An attacker who can influence a sheet name can inject an event-handler attribute and execute JavaScript when a user hovers over the menu button. Successful exploitation may compromise the confidentiality and integrity of data available in the user\u0027s browser context. The first affected version is 2024.4.1112; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111.\u003c/p\u003e"
            }
          ],
          "value": "In Progress Kendo UI for jQuery, Spreadsheet sheet names are inserted into the SheetsBar menu button\u0027s data-sheet-name attribute without encoding. An attacker who can influence a sheet name can inject an event-handler attribute and execute JavaScript when a user hovers over the menu button. Successful exploitation may compromise the confidentiality and integrity of data available in the user\u0027s browser context. The first affected version is 2024.4.1112; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-63",
          "descriptions": [
            {
              "lang": "en",
              "value": "Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-12T17:02:11.806Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-kendo-spreadsheet-sheet-names-xss-cve-2026-124696"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Cross-Site Scripting in Kendo UI for jQuery Spreadsheet Sheet Names",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-124696",
    "datePublished": "2026-11-12T17:02:11.806Z",
    "dateReserved": "2026-11-09T10:41:43.932Z",
    "dateUpdated": "2026-11-12T17:02:11.806Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124695 (GCVE-0-2026-124695)

Vulnerability from cvelistv5 – Published: 2026-11-12 16:52 – Updated: 2026-11-12 16:52

Title

Cross-Site Scripting in Kendo UI for jQuery Form Item Hints

Summary

In Progress Kendo UI for jQuery Form, the items[].hint option is documented as a string but is rendered as HTML. An attacker who can influence a Form item's hint can cause attacker-controlled markup to execute as JavaScript when a user views the rendered form. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected version is 2020.2.513; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 79/100 over 205 records in the last 180 days details

References

1 reference

URL	Tags
https://www.telerik.com/kendo-jquery-ui/documenta…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress Software	Kendo UI for jQuery	Affected: 2020.2.513 , ≤ 2026.3.1015 (custom)

Credits

Abhishek Nandkumar Bhaskar (Abhi-Hackz)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Kendo UI for jQuery",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThanOrEqual": "2026.3.1015",
              "status": "affected",
              "version": "2020.2.513",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abhishek Nandkumar Bhaskar (Abhi-Hackz)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Progress Kendo UI for jQuery Form, the items[].hint option is documented as a string but is rendered as HTML. An attacker who can influence a Form item\u0027s hint can cause attacker-controlled markup to execute as JavaScript when a user views the rendered form. Successful exploitation may compromise the confidentiality and integrity of data available in the user\u0027s browser context. The first affected version is 2020.2.513; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111.\u003c/p\u003e"
            }
          ],
          "value": "In Progress Kendo UI for jQuery Form, the items[].hint option is documented as a string but is rendered as HTML. An attacker who can influence a Form item\u0027s hint can cause attacker-controlled markup to execute as JavaScript when a user views the rendered form. Successful exploitation may compromise the confidentiality and integrity of data available in the user\u0027s browser context. The first affected version is 2020.2.513; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-63",
          "descriptions": [
            {
              "lang": "en",
              "value": "Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-12T16:52:14.648Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-kendo-form-item-hint-xss-cve-2026-124695"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Cross-Site Scripting in Kendo UI for jQuery Form Item Hints",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-124695",
    "datePublished": "2026-11-12T16:52:14.648Z",
    "dateReserved": "2026-11-09T10:41:42.890Z",
    "dateUpdated": "2026-11-12T16:52:14.648Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124691 (GCVE-0-2026-124691)

Vulnerability from cvelistv5 – Published: 2026-11-12 16:42 – Updated: 2026-11-12 16:47

Title

Cross-Site Scripting in Kendo UI for jQuery Gantt Parent Dropdown

Summary

In Progress Kendo UI for jQuery Gantt, the task editor's Parent dropdown renders task titles as HTML. An attacker who can influence a task title shown in the dropdown can cause attacker-controlled markup to execute as JavaScript when a user opens or interacts with the task editor. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected version is 2020.3.915; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 79/100 over 205 records in the last 180 days details

References

1 reference

URL	Tags
https://www.telerik.com/kendo-jquery-ui/documenta…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress Software	Kendo UI for jQuery	Affected: 2020.3.915 , ≤ 2026.3.1015 (custom)

Credits

Abhishek Nandkumar Bhaskar (Abhi-Hackz)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Kendo UI for jQuery",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThanOrEqual": "2026.3.1015",
              "status": "affected",
              "version": "2020.3.915",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abhishek Nandkumar Bhaskar (Abhi-Hackz)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Progress Kendo UI for jQuery Gantt, the task editor\u0027s Parent dropdown renders task titles as HTML. An attacker who can influence a task title shown in the dropdown can cause attacker-controlled markup to execute as JavaScript when a user opens or interacts with the task editor. Successful exploitation may compromise the confidentiality and integrity of data available in the user\u0027s browser context. The first affected version is 2020.3.915; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111.\u003c/p\u003e"
            }
          ],
          "value": "In Progress Kendo UI for jQuery Gantt, the task editor\u0027s Parent dropdown renders task titles as HTML. An attacker who can influence a task title shown in the dropdown can cause attacker-controlled markup to execute as JavaScript when a user opens or interacts with the task editor. Successful exploitation may compromise the confidentiality and integrity of data available in the user\u0027s browser context. The first affected version is 2020.3.915; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-63",
          "descriptions": [
            {
              "lang": "en",
              "value": "Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-12T16:47:05.093Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-kendo-gantt-parent-dropdown-xss-cve-2026-124691"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Cross-Site Scripting in Kendo UI for jQuery Gantt Parent Dropdown",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-124691",
    "datePublished": "2026-11-12T16:42:30.326Z",
    "dateReserved": "2026-11-09T10:41:42.890Z",
    "dateUpdated": "2026-11-12T16:47:05.093Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124694 (GCVE-0-2026-124694)

Vulnerability from cvelistv5 – Published: 2026-11-11 16:57 – Updated: 2026-11-11 16:57

Title

Cross-Site Scripting in Kendo UI for jQuery PropertyGrid Values and Descriptions

Summary

In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PropertyGrid does not encode bound property values and items[].description in its default configuration. An attacker who can influence either value can cause JavaScript to execute when a user views the grid. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected release has not been established.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 79/100 over 205 records in the last 180 days details

References

1 reference

URL	Tags
https://www.telerik.com/kendo-jquery-ui/documenta…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress Software	Kendo UI for jQuery	Affected: 2026.3.1015 , < 2026.4.1110 (custom) Unaffected: 2026.4.1110

Credits

Abhishek Nandkumar Bhaskar (Abhi-Hackz)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Kendo UI for jQuery",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThan": "2026.4.1110",
              "status": "affected",
              "version": "2026.3.1015",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2026.4.1110"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abhishek Nandkumar Bhaskar (Abhi-Hackz)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PropertyGrid does not encode bound property values and items[].description in its default configuration. An attacker who can influence either value can cause JavaScript to execute when a user views the grid. Successful exploitation may compromise the confidentiality and integrity of data available in the user\u0027s browser context. The first affected release has not been established.\u003c/p\u003e"
            }
          ],
          "value": "In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PropertyGrid does not encode bound property values and items[].description in its default configuration. An attacker who can influence either value can cause JavaScript to execute when a user views the grid. Successful exploitation may compromise the confidentiality and integrity of data available in the user\u0027s browser context. The first affected release has not been established."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T16:57:45.440Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-kendo-propertygrid-bound-values-description-xss-cve-2026-124694"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Cross-Site Scripting in Kendo UI for jQuery PropertyGrid Values and Descriptions",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-124694",
    "datePublished": "2026-11-11T16:57:45.440Z",
    "dateReserved": "2026-11-09T10:41:42.890Z",
    "dateUpdated": "2026-11-11T16:57:45.440Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124693 (GCVE-0-2026-124693)

Vulnerability from cvelistv5 – Published: 2026-11-11 16:54 – Updated: 2026-11-11 16:54

Title

Cross-Site Scripting in Kendo UI for jQuery PivotGrid Axis Chips

Summary

In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PivotGrid and PivotConfigurator axis field names are passed to a chip template without appropriate encoding. An attacker who can influence an axis field name can cause JavaScript to execute when a user views the rendered chip. The field name can be interpreted as HTML in both attribute and element contexts. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected release has not been established.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 79/100 over 205 records in the last 180 days details

References

1 reference

URL	Tags
https://www.telerik.com/kendo-jquery-ui/documenta…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress Software	Kendo UI for jQuery	Affected: 2026.3.1015 , < 2026.4.1110 (custom) Unaffected: 2026.4.1110

Credits

Abhishek Nandkumar Bhaskar (Abhi-Hackz)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Kendo UI for jQuery",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThan": "2026.4.1110",
              "status": "affected",
              "version": "2026.3.1015",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2026.4.1110"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abhishek Nandkumar Bhaskar (Abhi-Hackz)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PivotGrid and PivotConfigurator axis field names are passed to a chip template without appropriate encoding. An attacker who can influence an axis field name can cause JavaScript to execute when a user views the rendered chip. The field name can be interpreted as HTML in both attribute and element contexts. Successful exploitation may compromise the confidentiality and integrity of data available in the user\u0027s browser context. The first affected release has not been established.\u003c/p\u003e"
            }
          ],
          "value": "In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PivotGrid and PivotConfigurator axis field names are passed to a chip template without appropriate encoding. An attacker who can influence an axis field name can cause JavaScript to execute when a user views the rendered chip. The field name can be interpreted as HTML in both attribute and element contexts. Successful exploitation may compromise the confidentiality and integrity of data available in the user\u0027s browser context. The first affected release has not been established."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T16:54:21.803Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-kendo-pivotgrid-pivotconfigurator-axis-chip-xss-cve-2026-124693"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Cross-Site Scripting in Kendo UI for jQuery PivotGrid Axis Chips",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-124693",
    "datePublished": "2026-11-11T16:54:21.803Z",
    "dateReserved": "2026-11-09T10:41:42.890Z",
    "dateUpdated": "2026-11-11T16:54:21.803Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124692 (GCVE-0-2026-124692)

Vulnerability from cvelistv5 – Published: 2026-11-11 16:52 – Updated: 2026-11-11 16:52

Title

Cross-Site Scripting in Kendo UI for jQuery Grid and TreeList Column Reordering

Summary

In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, the Grid and TreeList column-reorder drag clue reparses header text as HTML. An attacker who can influence a column field or title used by an affected application can cause JavaScript to execute when a user drags a column header while column reordering is enabled. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected release has not been established.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 79/100 over 205 records in the last 180 days details

References

1 reference

URL	Tags
https://www.telerik.com/kendo-jquery-ui/documenta…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress Software	Kendo UI for jQuery	Affected: 2026.3.1015 , < 2026.4.1110 (custom) Unaffected: 2026.4.1110

Credits

Abhishek Nandkumar Bhaskar (Abhi-Hackz)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Kendo UI for jQuery",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThan": "2026.4.1110",
              "status": "affected",
              "version": "2026.3.1015",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2026.4.1110"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abhishek Nandkumar Bhaskar (Abhi-Hackz)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, the Grid and TreeList column-reorder drag clue reparses header text as HTML. An attacker who can influence a column field or title used by an affected application can cause JavaScript to execute when a user drags a column header while column reordering is enabled. Successful exploitation may compromise the confidentiality and integrity of data available in the user\u0027s browser context. The first affected release has not been established.\u003c/p\u003e"
            }
          ],
          "value": "In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, the Grid and TreeList column-reorder drag clue reparses header text as HTML. An attacker who can influence a column field or title used by an affected application can cause JavaScript to execute when a user drags a column header while column reordering is enabled. Successful exploitation may compromise the confidentiality and integrity of data available in the user\u0027s browser context. The first affected release has not been established."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T16:52:26.328Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-kendo-grid-treelist-column-reorder-drag-clue-xss-cve-2026-124692"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Cross-Site Scripting in Kendo UI for jQuery Grid and TreeList Column Reordering",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-124692",
    "datePublished": "2026-11-11T16:52:26.328Z",
    "dateReserved": "2026-11-09T10:41:42.890Z",
    "dateUpdated": "2026-11-11T16:52:26.328Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124690 (GCVE-0-2026-124690)

Vulnerability from cvelistv5 – Published: 2026-11-11 16:50 – Updated: 2026-11-11 16:50

Title

Cross-Site Scripting During Kendo UI for jQuery Custom SVG Icon Sanitization

Summary

In Progress Kendo UI for jQuery, sanitizeSvgContent() parses custom icon markup into a live DOM before filtering it. An attacker who can influence custom icon content can cause JavaScript to execute during icon creation, before an unsafe element is removed. The issue was reported in version 2026.3.1015; the first affected release has not been established. The issue is fixed in version 2026.4.1110.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 79/100 over 205 records in the last 180 days details

References

1 reference

URL	Tags
https://www.telerik.com/kendo-jquery-ui/documenta…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress Software	Kendo UI for jQuery	Affected: 2026.3.1015 , < 2026.4.1110 (custom) Unaffected: 2026.4.1110

Credits

Abhishek Nandkumar Bhaskar (Abhi-Hackz)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Kendo UI for jQuery",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThan": "2026.4.1110",
              "status": "affected",
              "version": "2026.3.1015",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2026.4.1110"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abhishek Nandkumar Bhaskar (Abhi-Hackz)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Progress Kendo UI for jQuery, sanitizeSvgContent() parses custom icon markup into a live DOM before filtering it. An attacker who can influence custom icon content can cause JavaScript to execute during icon creation, before an unsafe element is removed. The issue was reported in version 2026.3.1015; the first affected release has not been established. The issue is fixed in version 2026.4.1110.\u003c/p\u003e"
            }
          ],
          "value": "In Progress Kendo UI for jQuery, sanitizeSvgContent() parses custom icon markup into a live DOM before filtering it. An attacker who can influence custom icon content can cause JavaScript to execute during icon creation, before an unsafe element is removed. The issue was reported in version 2026.3.1015; the first affected release has not been established. The issue is fixed in version 2026.4.1110."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T16:50:59.752Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-kendo-svg-icon-sanitizer-xss-cve-2026-124690"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Cross-Site Scripting During Kendo UI for jQuery Custom SVG Icon Sanitization",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-124690",
    "datePublished": "2026-11-11T16:50:59.752Z",
    "dateReserved": "2026-11-09T10:41:42.889Z",
    "dateUpdated": "2026-11-11T16:50:59.752Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124689 (GCVE-0-2026-124689)

Vulnerability from cvelistv5 – Published: 2026-11-11 16:48 – Updated: 2026-11-11 16:48

Title

Cross-Site Scripting in Kendo UI for jQuery ActionSheet Header Labels

Summary

In Progress Kendo UI for jQuery versions 2026.3.1014 up to, but not including, 2026.4.1110, ActionSheet does not encode title, subtitle, and header button label values before rendering them. An attacker who can influence these values can inject markup that executes as JavaScript when a user opens the ActionSheet. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The report identifies version 2026.3.1014; the first affected release has not been established.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 79/100 over 205 records in the last 180 days details

References

1 reference

URL	Tags
https://www.telerik.com/kendo-jquery-ui/documenta…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress Software	Kendo UI for jQuery	Affected: 2026.3.1014 , < 2026.4.1110 (custom) Unaffected: 2026.4.1110

Credits

Abhishek Nandkumar Bhaskar (Abhi-Hackz)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Kendo UI for jQuery",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThan": "2026.4.1110",
              "status": "affected",
              "version": "2026.3.1014",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2026.4.1110"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abhishek Nandkumar Bhaskar (Abhi-Hackz)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Progress Kendo UI for jQuery versions 2026.3.1014 up to, but not including, 2026.4.1110, ActionSheet does not encode title, subtitle, and header button label values before rendering them. An attacker who can influence these values can inject markup that executes as JavaScript when a user opens the ActionSheet. Successful exploitation may compromise the confidentiality and integrity of data available in the user\u0027s browser context. The report identifies version 2026.3.1014; the first affected release has not been established.\u003c/p\u003e"
            }
          ],
          "value": "In Progress Kendo UI for jQuery versions 2026.3.1014 up to, but not including, 2026.4.1110, ActionSheet does not encode title, subtitle, and header button label values before rendering them. An attacker who can influence these values can inject markup that executes as JavaScript when a user opens the ActionSheet. Successful exploitation may compromise the confidentiality and integrity of data available in the user\u0027s browser context. The report identifies version 2026.3.1014; the first affected release has not been established."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-63",
          "descriptions": [
            {
              "lang": "en",
              "value": "Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T16:48:21.531Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-kendo-actionsheet-header-xss-cve-2026-124689"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Cross-Site Scripting in Kendo UI for jQuery ActionSheet Header Labels",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-124689",
    "datePublished": "2026-11-11T16:48:21.531Z",
    "dateReserved": "2026-11-09T10:41:42.889Z",
    "dateUpdated": "2026-11-11T16:48:21.531Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124688 (GCVE-0-2026-124688)

Vulnerability from cvelistv5 – Published: 2026-11-11 16:44 – Updated: 2026-11-11 16:44

Title

Cross-Site Scripting via the spriteCssClass Field in Kendo UI for jQuery

Summary

In Progress® Kendo® UI for jQuery prior to 2026.4.1111 the TabStrip, PanelBar, and Menu widgets support mapping a dataSource field to `spriteCssClass`. If an attacker can control the mapped data, they can break out of the attribute and inject markup, including event-handler attributes. The resulting JavaScript executes in the application's origin when a victim loads a page that renders the affected widget, allowing access to data and actions available in the victim's authenticated session.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CWE

CWE-80 - Improper neutralization of Script-Related HTML tags in a web page (basic XSS)

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 79/100 over 205 records in the last 180 days details

References

1 reference

URL	Tags
https://www.telerik.com/kendo-jquery-ui/documenta…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress Software	Kendo UI for jQuery	Affected: 2012.1.322 , < 2026.4.1111 (custom)

Credits

Suryansh Narang

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Kendo UI for jQuery",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThan": "2026.4.1111",
              "status": "affected",
              "version": "2012.1.322",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Suryansh Narang"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Progress\u00ae Kendo\u00ae UI for jQuery prior to\u0026nbsp;\u003cspan\u003e2026.4.1111 \u003c/span\u003ethe TabStrip, PanelBar, and Menu widgets support mapping a dataSource field to `spriteCssClass`. If an attacker can control the mapped data, they can break out of the attribute and inject markup, including event-handler attributes. The resulting JavaScript executes in the application\u0027s origin when a victim loads a page that renders the affected widget, allowing access to data and actions available in the victim\u0027s authenticated session.\u003c/p\u003e"
            }
          ],
          "value": "In Progress\u00ae Kendo\u00ae UI for jQuery prior to\u00a02026.4.1111 the TabStrip, PanelBar, and Menu widgets support mapping a dataSource field to `spriteCssClass`. If an attacker can control the mapped data, they can break out of the attribute and inject markup, including event-handler attributes. The resulting JavaScript executes in the application\u0027s origin when a victim loads a page that renders the affected widget, allowing access to data and actions available in the victim\u0027s authenticated session."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "XSS Targeting Non-Script Elements"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-80",
              "description": "CWE-80 Improper neutralization of Script-Related HTML tags in a web page (basic XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T16:44:32.121Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-tabstrip-panelbar-menu-spritecssclass-xss-cve-2026-124688"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Cross-Site Scripting via the spriteCssClass Field in Kendo UI for jQuery",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-124688",
    "datePublished": "2026-11-11T16:44:32.121Z",
    "dateReserved": "2026-11-09T10:41:42.889Z",
    "dateUpdated": "2026-11-11T16:44:32.121Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124687 (GCVE-0-2026-124687)

Vulnerability from cvelistv5 – Published: 2026-11-11 16:25 – Updated: 2026-11-11 16:25

Title

Cross-Site Scripting in DropDownButton and SplitButton Items in Kendo UI for jQuery

Summary

In Progress® Kendo® UI for jQuery versions from 2022.2.621 prior to 2026.4.1111 the DropDownButton and SplitButton allow markup injection through the `id` and `target` attributes. An attacker who can influence these item values can break out of the attributes and inject markup, including event handlers. The issue is fixed in 2026.4.1111.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CWE

CWE-80 - Improper neutralization of Script-Related HTML tags in a web page (basic XSS)

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 79/100 over 205 records in the last 180 days details

References

1 reference

URL	Tags
https://www.telerik.com/kendo-jquery-ui/documenta…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress Software	Kendo UI for jQuery	Affected: 2022.2.621 , < 2026.4.1111 (custom)

Credits

Abhishek Nandkumar Bhaskar (Abhi-Hackz)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Kendo UI for jQuery",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThan": "2026.4.1111",
              "status": "affected",
              "version": "2022.2.621",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abhishek Nandkumar Bhaskar (Abhi-Hackz)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Progress\u00ae Kendo\u00ae UI for jQuery versions from 2022.2.621 prior to\u0026nbsp;\u003cspan\u003e2026.4.1111\u003c/span\u003e\u0026nbsp;the DropDownButton and SplitButton allow markup injection through the `id` and `target` attributes. An attacker who can influence these item values can break out of the attributes and inject markup, including event handlers. The issue is fixed in\u0026nbsp;\u003cspan\u003e2026.4.1111\u003c/span\u003e.\u003c/p\u003e"
            }
          ],
          "value": "In Progress\u00ae Kendo\u00ae UI for jQuery versions from 2022.2.621 prior to\u00a02026.4.1111\u00a0the DropDownButton and SplitButton allow markup injection through the `id` and `target` attributes. An attacker who can influence these item values can break out of the attributes and inject markup, including event handlers. The issue is fixed in\u00a02026.4.1111."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "XSS Targeting Non-Script Elements"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-80",
              "description": "CWE-80 Improper neutralization of Script-Related HTML tags in a web page (basic XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T16:25:03.748Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-dropdownbutton-splitbutton-items-attribute-xss-cve-2026-124687"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Cross-Site Scripting in DropDownButton and SplitButton Items in Kendo UI for jQuery",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-124687",
    "datePublished": "2026-11-11T16:25:03.748Z",
    "dateReserved": "2026-11-09T10:41:42.889Z",
    "dateUpdated": "2026-11-11T16:25:03.748Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124686 (GCVE-0-2026-124686)

Vulnerability from cvelistv5 – Published: 2026-11-11 15:27 – Updated: 2026-11-11 15:27

Title

JavaScript Code Injection through kendo.init() in Kendo UI for jQuery

Summary

In Progress® Kendo® UI for jQuery versions prior to 2026.4.1111, kendo.init() compiles data-* attribute values with new Function when an invalid JSON object is supplied. An attacker with low privileges who can control these attribute values can inject JavaScript that executes during declarative widget initialization when a user loads or interacts with an affected page. Successful exploitation can compromise the confidentiality and integrity of data accessible in the user's browser context. The issue was reported in version 2022.3.1109; the first affected release has not been established.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWE

CWE-95 - Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 79/100 over 205 records in the last 180 days details

References

1 reference

URL	Tags
https://www.telerik.com/kendo-jquery-ui/documenta…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress Software	Kendo UI for jQuery	Affected: 2022.3.1109 , < 2026.4.1111 (custom) Unaffected: 2026.4.1111

Credits

Abhishek Nandkumar Bhaskar (Abhi-Hackz)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Kendo UI for jQuery",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThan": "2026.4.1111",
              "status": "affected",
              "version": "2022.3.1109",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2026.4.1111"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abhishek Nandkumar Bhaskar (Abhi-Hackz)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Progress\u00ae Kendo\u00ae UI for jQuery versions prior to 2026.4.1111, kendo.init() compiles data-* attribute values with new Function when an invalid JSON object is supplied. An attacker with low privileges who can control these attribute values can inject JavaScript that executes during declarative widget initialization when a user loads or interacts with an affected page. Successful exploitation can compromise the confidentiality and integrity of data accessible in the user\u0027s browser context. The issue was reported in version 2022.3.1109; the first affected release has not been established.\u003c/p\u003e"
            }
          ],
          "value": "In Progress\u00ae Kendo\u00ae UI for jQuery versions prior to 2026.4.1111, kendo.init() compiles data-* attribute values with new Function when an invalid JSON object is supplied. An attacker with low privileges who can control these attribute values can inject JavaScript that executes during declarative widget initialization when a user loads or interacts with an affected page. Successful exploitation can compromise the confidentiality and integrity of data accessible in the user\u0027s browser context. The issue was reported in version 2022.3.1109; the first affected release has not been established."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Code Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-95",
              "description": "CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T15:27:32.762Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-kendo-init-code-injection-cve-2026-124686"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "JavaScript Code Injection through kendo.init() in Kendo UI for jQuery",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-124686",
    "datePublished": "2026-11-11T15:27:32.762Z",
    "dateReserved": "2026-11-09T10:41:42.889Z",
    "dateUpdated": "2026-11-11T15:27:32.762Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

56 vulnerabilities found for Kendo UI for jQuery by Progress Software

CVE-2026-124698 (GCVE-0-2026-124698)

CVE-2026-124697 (GCVE-0-2026-124697)

CVE-2026-124696 (GCVE-0-2026-124696)

CVE-2026-124695 (GCVE-0-2026-124695)

CVE-2026-124691 (GCVE-0-2026-124691)

CVE-2026-124694 (GCVE-0-2026-124694)

CVE-2026-124693 (GCVE-0-2026-124693)

CVE-2026-124692 (GCVE-0-2026-124692)

CVE-2026-124690 (GCVE-0-2026-124690)

CVE-2026-124689 (GCVE-0-2026-124689)

CVE-2026-124688 (GCVE-0-2026-124688)

CVE-2026-124687 (GCVE-0-2026-124687)

CVE-2026-124686 (GCVE-0-2026-124686)

CVE-2026-108116 (GCVE-0-2026-108116)

CVE-2026-106153 (GCVE-0-2026-106153)

CVE-2026-106151 (GCVE-0-2026-106151)

CVE-2026-106150 (GCVE-0-2026-106150)

CVE-2026-124698 (GCVE-0-2026-124698)

CVE-2026-124697 (GCVE-0-2026-124697)

CVE-2026-124696 (GCVE-0-2026-124696)

CVE-2026-124695 (GCVE-0-2026-124695)

CVE-2026-124691 (GCVE-0-2026-124691)

CVE-2026-124694 (GCVE-0-2026-124694)

CVE-2026-124693 (GCVE-0-2026-124693)

CVE-2026-124692 (GCVE-0-2026-124692)

CVE-2026-124690 (GCVE-0-2026-124690)

CVE-2026-124689 (GCVE-0-2026-124689)

CVE-2026-124688 (GCVE-0-2026-124688)

CVE-2026-124687 (GCVE-0-2026-124687)

CVE-2026-124686 (GCVE-0-2026-124686)