Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-106154 (GCVE-0-2026-106154)

Vulnerability from nvd – Published: 2026-11-12 17:13 – Updated: 2026-11-12 17:13

Title

Uncontrolled Recursion in Telerik UI for ASP.NET Core FilterParser

Summary

In Progress® Telerik® UI for ASP.NET Core versions `2015.1.318` through `2026.3.1015`, the server-side FilterParser processes nested expressions in untrusted filter parameters through recursive parsing without a recursion-depth limit, while FilterLexer does not enforce an input-length limit. An unauthenticated remote attacker can exploit this if the application exposes an endpoint using DataSourceRequest model binding that is reachable without authentication. Deeply nested filters can trigger parsing errors during model binding or cause `StackOverflowException`. This issue is fixed in version `2026.4.1111`.

Severity

8.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

CWE

CWE-674 - Uncontrolled Recursion

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 79/100 over 205 records in the last 180 days details

References

1 reference

URL	Tags
https://www.telerik.com/aspnet-core-ui/documentat…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress Software	Telerik UI for ASP.NET Core	Affected: 2015.1.318 , ≤ 2026.3.1015 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Telerik UI for ASP.NET Core",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThanOrEqual": "2026.3.1015",
              "status": "affected",
              "version": "2015.1.318",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Progress\u00ae Telerik\u00ae UI for ASP.NET Core versions `2015.1.318` through `2026.3.1015`, the server-side FilterParser processes nested expressions in untrusted filter parameters through recursive parsing without a recursion-depth limit, while FilterLexer does not enforce an input-length limit. An unauthenticated remote attacker can exploit this if the application exposes an endpoint using DataSourceRequest model binding that is reachable without authentication. Deeply nested filters can trigger parsing errors during model binding or cause `StackOverflowException`. This issue is fixed in version `2026.4.1111`.\u003c/p\u003e"
            }
          ],
          "value": "In Progress\u00ae Telerik\u00ae UI for ASP.NET Core versions `2015.1.318` through `2026.3.1015`, the server-side FilterParser processes nested expressions in untrusted filter parameters through recursive parsing without a recursion-depth limit, while FilterLexer does not enforce an input-length limit. An unauthenticated remote attacker can exploit this if the application exposes an endpoint using DataSourceRequest model binding that is reachable without authentication. Deeply nested filters can trigger parsing errors during model binding or cause `StackOverflowException`. This issue is fixed in version `2026.4.1111`."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-230",
          "descriptions": [
            {
              "lang": "en",
              "value": "Serialized Data Parameter Blowup"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674 Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-12T17:13:26.499Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.telerik.com/aspnet-core-ui/documentation/knowledge-base/kb-security-uncontrolled-recursion-cve-2026-106154"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Uncontrolled Recursion in Telerik UI for ASP.NET Core FilterParser",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-106154",
    "datePublished": "2026-11-12T17:13:26.499Z",
    "dateReserved": "2026-10-06T15:51:11.738Z",
    "dateUpdated": "2026-11-12T17:13:26.499Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-106156 (GCVE-0-2026-106156)

Vulnerability from nvd – Published: 2026-11-11 17:24 – Updated: 2026-11-11 17:24

Title

Uncontrolled Resource Consumption in Telerik UI for ASP.NET Core Server-side Aggregation

Summary

In Progress® Telerik® UI for ASP.NET Core versions `2015.1.318` through `2026.3.811`, repeated server-side aggregation requests, with or without grouping, cause dynamic assemblies and load contexts to be retained, resulting in accumulating process memory consumption. An unauthenticated remote attacker can exploit this if the application exposes an aggregation endpoint that is reachable without authentication. Repeated requests can cause memory growth that may exhaust available resources and affect application availability. Disabling grouping in the client-side interface does not prevent direct requests containing these descriptors. The issue is fixed in version `2026.3.1015`.

Severity

8.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 79/100 over 205 records in the last 180 days details

References

1 reference

URL	Tags
https://www.telerik.com/aspnet-core-ui/documentat…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress Software	Telerik UI for ASP.NET Core	Affected: 2015.1.318 , < 2026.3.1015 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Telerik UI for ASP.NET Core",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThan": "2026.3.1015",
              "status": "affected",
              "version": "2015.1.318",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Progress\u00ae Telerik\u00ae UI for ASP.NET Core versions `2015.1.318` through `2026.3.811`, repeated server-side aggregation requests, with or without grouping, cause dynamic assemblies and load contexts to be retained, resulting in accumulating process memory consumption. An unauthenticated remote attacker can exploit this if the application exposes an aggregation endpoint that is reachable without authentication. Repeated requests can cause memory growth that may exhaust available resources and affect application availability. Disabling grouping in the client-side interface does not prevent direct requests containing these descriptors. The issue is fixed in version `2026.3.1015`.\u003c/p\u003e"
            }
          ],
          "value": "In Progress\u00ae Telerik\u00ae UI for ASP.NET Core versions `2015.1.318` through `2026.3.811`, repeated server-side aggregation requests, with or without grouping, cause dynamic assemblies and load contexts to be retained, resulting in accumulating process memory consumption. An unauthenticated remote attacker can exploit this if the application exposes an aggregation endpoint that is reachable without authentication. Repeated requests can cause memory growth that may exhaust available resources and affect application availability. Disabling grouping in the client-side interface does not prevent direct requests containing these descriptors. The issue is fixed in version `2026.3.1015`."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Excessive Allocation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400 Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T17:24:56.315Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.telerik.com/aspnet-core-ui/documentation/knowledge-base/kb-security-uncontrolled-resource-consumption-cve-2026-106156"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Uncontrolled Resource Consumption in Telerik UI for ASP.NET Core Server-side Aggregation",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-106156",
    "datePublished": "2026-11-11T17:24:56.315Z",
    "dateReserved": "2026-10-06T15:51:11.738Z",
    "dateUpdated": "2026-11-11T17:24:56.315Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-6725 (GCVE-0-2025-6725)

Vulnerability from nvd – Published: 2025-07-02 14:39 – Updated: 2025-07-02 14:54

Title

Cross-Site Scripting (XSS) in PdfViewer

Summary

In the PdfViewer component, a Cross-Site Scripting (XSS) vulnerability is possible if a specially-crafted document has already been loaded and the user engages with a tool that requires the DOM to be re-rendered.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-07-02 14:53 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 79/100 over 205 records in the last 180 days details

References

6 references

URL	Tags
https://www.telerik.com/blazor-ui/documentation/k…
https://www.telerik.com/aspnet-core-ui/documentat…
https://www.telerik.com/aspnet-mvc/documentation/…
https://www.telerik.com/kendo-jquery-ui/documenta…
https://www.telerik.com/kendo-angular-ui/componen…
https://www.telerik.com/kendo-react-ui/components…

Impacted products

6 products

Vendor	Product	Version
Progress Software	Kendo UI for jQuery	Affected: 2024.4.1112 , ≤ 2025.2.520 (custom)
Progress Software	Kendo UI for Angular	Affected: 18.5.0 , ≤ 19.1.2 (semver)
Progress Software	KendoReact	Affected: 5.10.0 , ≤ 11.1.0 (semver)
Progress Software	Telerik UI for ASP.NET MVC	Affected: 2024.4.1112 , ≤ 2025.2.520 (custom)
Progress Software	Telerik UI for ASP.NET Core	Affected: 2024.4.1112 , ≤ 2025.2.520 (custom)
Progress Software	Telerik UI for Blazor	Affected: 3.6.0 , ≤ 9.0.0 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-6725",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-02T14:53:43.290872Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-02T14:54:14.971Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Kendo UI for jQuery",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThanOrEqual": "2025.2.520",
              "status": "affected",
              "version": "2024.4.1112",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Kendo UI for Angular",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThanOrEqual": "19.1.2",
              "status": "affected",
              "version": "18.5.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "KendoReact",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThanOrEqual": "11.1.0",
              "status": "affected",
              "version": "5.10.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Telerik UI for ASP.NET MVC",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThanOrEqual": "2025.2.520",
              "status": "affected",
              "version": "2024.4.1112",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Telerik UI for ASP.NET Core",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThanOrEqual": "2025.2.520",
              "status": "affected",
              "version": "2024.4.1112",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Telerik UI for Blazor",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThanOrEqual": "9.0.0",
              "status": "affected",
              "version": "3.6.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn the PdfViewer component, a Cross-Site Scripting (XSS) vulnerability is possible if a specially-crafted document has already been loaded and the user engages with a tool that requires the DOM to be re-rendered.\u003c/p\u003e"
            }
          ],
          "value": "In the PdfViewer component, a Cross-Site Scripting (XSS) vulnerability is possible if a specially-crafted document has already been loaded and the user engages with a tool that requires the DOM to be re-rendered."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-63",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-63 Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-02T14:39:15.442Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "url": "https://www.telerik.com/blazor-ui/documentation/knowledge-base/pdfviewer-xss-vulnerability-cve-2025-6725"
        },
        {
          "url": "https://www.telerik.com/aspnet-core-ui/documentation/knowledge-base/kb-security-pdfviewer-xss-cve-2025-6725"
        },
        {
          "url": "https://www.telerik.com/aspnet-mvc/documentation/knowledge-base/kb-security-pdfviewer-xss-cve-2025-6725"
        },
        {
          "url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-pdfviewer-xss-cve-2025-6725"
        },
        {
          "url": "https://www.telerik.com/kendo-angular-ui/components/knowledge-base/kb-security-pdfviewer-xss-cve-2025-6725"
        },
        {
          "url": "https://www.telerik.com/kendo-react-ui/components/knowledge-base/kb-security-pdfviewer-xss-cve-2025-6725"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Cross-Site Scripting (XSS) in PdfViewer",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2025-6725",
    "datePublished": "2025-07-02T14:39:15.442Z",
    "dateReserved": "2025-06-26T14:27:40.423Z",
    "dateUpdated": "2025-07-02T14:54:14.971Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2026-106154 (GCVE-0-2026-106154)

Vulnerability from cvelistv5 – Published: 2026-11-12 17:13 – Updated: 2026-11-12 17:13

Title

Uncontrolled Recursion in Telerik UI for ASP.NET Core FilterParser

Summary

In Progress® Telerik® UI for ASP.NET Core versions `2015.1.318` through `2026.3.1015`, the server-side FilterParser processes nested expressions in untrusted filter parameters through recursive parsing without a recursion-depth limit, while FilterLexer does not enforce an input-length limit. An unauthenticated remote attacker can exploit this if the application exposes an endpoint using DataSourceRequest model binding that is reachable without authentication. Deeply nested filters can trigger parsing errors during model binding or cause `StackOverflowException`. This issue is fixed in version `2026.4.1111`.

Severity

8.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

CWE

CWE-674 - Uncontrolled Recursion

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 79/100 over 205 records in the last 180 days details

References

1 reference

URL	Tags
https://www.telerik.com/aspnet-core-ui/documentat…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress Software	Telerik UI for ASP.NET Core	Affected: 2015.1.318 , ≤ 2026.3.1015 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Telerik UI for ASP.NET Core",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThanOrEqual": "2026.3.1015",
              "status": "affected",
              "version": "2015.1.318",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Progress\u00ae Telerik\u00ae UI for ASP.NET Core versions `2015.1.318` through `2026.3.1015`, the server-side FilterParser processes nested expressions in untrusted filter parameters through recursive parsing without a recursion-depth limit, while FilterLexer does not enforce an input-length limit. An unauthenticated remote attacker can exploit this if the application exposes an endpoint using DataSourceRequest model binding that is reachable without authentication. Deeply nested filters can trigger parsing errors during model binding or cause `StackOverflowException`. This issue is fixed in version `2026.4.1111`.\u003c/p\u003e"
            }
          ],
          "value": "In Progress\u00ae Telerik\u00ae UI for ASP.NET Core versions `2015.1.318` through `2026.3.1015`, the server-side FilterParser processes nested expressions in untrusted filter parameters through recursive parsing without a recursion-depth limit, while FilterLexer does not enforce an input-length limit. An unauthenticated remote attacker can exploit this if the application exposes an endpoint using DataSourceRequest model binding that is reachable without authentication. Deeply nested filters can trigger parsing errors during model binding or cause `StackOverflowException`. This issue is fixed in version `2026.4.1111`."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-230",
          "descriptions": [
            {
              "lang": "en",
              "value": "Serialized Data Parameter Blowup"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674 Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-12T17:13:26.499Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.telerik.com/aspnet-core-ui/documentation/knowledge-base/kb-security-uncontrolled-recursion-cve-2026-106154"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Uncontrolled Recursion in Telerik UI for ASP.NET Core FilterParser",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-106154",
    "datePublished": "2026-11-12T17:13:26.499Z",
    "dateReserved": "2026-10-06T15:51:11.738Z",
    "dateUpdated": "2026-11-12T17:13:26.499Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-106156 (GCVE-0-2026-106156)

Vulnerability from cvelistv5 – Published: 2026-11-11 17:24 – Updated: 2026-11-11 17:24

Title

Uncontrolled Resource Consumption in Telerik UI for ASP.NET Core Server-side Aggregation

Summary

In Progress® Telerik® UI for ASP.NET Core versions `2015.1.318` through `2026.3.811`, repeated server-side aggregation requests, with or without grouping, cause dynamic assemblies and load contexts to be retained, resulting in accumulating process memory consumption. An unauthenticated remote attacker can exploit this if the application exposes an aggregation endpoint that is reachable without authentication. Repeated requests can cause memory growth that may exhaust available resources and affect application availability. Disabling grouping in the client-side interface does not prevent direct requests containing these descriptors. The issue is fixed in version `2026.3.1015`.

Severity

8.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 79/100 over 205 records in the last 180 days details

References

1 reference

URL	Tags
https://www.telerik.com/aspnet-core-ui/documentat…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Progress Software	Telerik UI for ASP.NET Core	Affected: 2015.1.318 , < 2026.3.1015 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Telerik UI for ASP.NET Core",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThan": "2026.3.1015",
              "status": "affected",
              "version": "2015.1.318",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn Progress\u00ae Telerik\u00ae UI for ASP.NET Core versions `2015.1.318` through `2026.3.811`, repeated server-side aggregation requests, with or without grouping, cause dynamic assemblies and load contexts to be retained, resulting in accumulating process memory consumption. An unauthenticated remote attacker can exploit this if the application exposes an aggregation endpoint that is reachable without authentication. Repeated requests can cause memory growth that may exhaust available resources and affect application availability. Disabling grouping in the client-side interface does not prevent direct requests containing these descriptors. The issue is fixed in version `2026.3.1015`.\u003c/p\u003e"
            }
          ],
          "value": "In Progress\u00ae Telerik\u00ae UI for ASP.NET Core versions `2015.1.318` through `2026.3.811`, repeated server-side aggregation requests, with or without grouping, cause dynamic assemblies and load contexts to be retained, resulting in accumulating process memory consumption. An unauthenticated remote attacker can exploit this if the application exposes an aggregation endpoint that is reachable without authentication. Repeated requests can cause memory growth that may exhaust available resources and affect application availability. Disabling grouping in the client-side interface does not prevent direct requests containing these descriptors. The issue is fixed in version `2026.3.1015`."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Excessive Allocation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400 Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-11T17:24:56.315Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.telerik.com/aspnet-core-ui/documentation/knowledge-base/kb-security-uncontrolled-resource-consumption-cve-2026-106156"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Uncontrolled Resource Consumption in Telerik UI for ASP.NET Core Server-side Aggregation",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2026-106156",
    "datePublished": "2026-11-11T17:24:56.315Z",
    "dateReserved": "2026-10-06T15:51:11.738Z",
    "dateUpdated": "2026-11-11T17:24:56.315Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-6725 (GCVE-0-2025-6725)

Vulnerability from cvelistv5 – Published: 2025-07-02 14:39 – Updated: 2025-07-02 14:54

Title

Cross-Site Scripting (XSS) in PdfViewer

Summary

In the PdfViewer component, a Cross-Site Scripting (XSS) vulnerability is possible if a specially-crafted document has already been loaded and the user engages with a tool that requires the DOM to be re-rendered.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-07-02 14:53 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Assigner

ProgressSoftware CNA under the mitre root

CNA scorecard B 79/100 over 205 records in the last 180 days details

References

6 references

URL	Tags
https://www.telerik.com/blazor-ui/documentation/k…
https://www.telerik.com/aspnet-core-ui/documentat…
https://www.telerik.com/aspnet-mvc/documentation/…
https://www.telerik.com/kendo-jquery-ui/documenta…
https://www.telerik.com/kendo-angular-ui/componen…
https://www.telerik.com/kendo-react-ui/components…

Impacted products

6 products

Vendor	Product	Version
Progress Software	Kendo UI for jQuery	Affected: 2024.4.1112 , ≤ 2025.2.520 (custom)
Progress Software	Kendo UI for Angular	Affected: 18.5.0 , ≤ 19.1.2 (semver)
Progress Software	KendoReact	Affected: 5.10.0 , ≤ 11.1.0 (semver)
Progress Software	Telerik UI for ASP.NET MVC	Affected: 2024.4.1112 , ≤ 2025.2.520 (custom)
Progress Software	Telerik UI for ASP.NET Core	Affected: 2024.4.1112 , ≤ 2025.2.520 (custom)
Progress Software	Telerik UI for Blazor	Affected: 3.6.0 , ≤ 9.0.0 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-6725",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-02T14:53:43.290872Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-02T14:54:14.971Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Kendo UI for jQuery",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThanOrEqual": "2025.2.520",
              "status": "affected",
              "version": "2024.4.1112",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Kendo UI for Angular",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThanOrEqual": "19.1.2",
              "status": "affected",
              "version": "18.5.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "KendoReact",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThanOrEqual": "11.1.0",
              "status": "affected",
              "version": "5.10.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Telerik UI for ASP.NET MVC",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThanOrEqual": "2025.2.520",
              "status": "affected",
              "version": "2024.4.1112",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Telerik UI for ASP.NET Core",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThanOrEqual": "2025.2.520",
              "status": "affected",
              "version": "2024.4.1112",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Telerik UI for Blazor",
          "vendor": "Progress Software",
          "versions": [
            {
              "lessThanOrEqual": "9.0.0",
              "status": "affected",
              "version": "3.6.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn the PdfViewer component, a Cross-Site Scripting (XSS) vulnerability is possible if a specially-crafted document has already been loaded and the user engages with a tool that requires the DOM to be re-rendered.\u003c/p\u003e"
            }
          ],
          "value": "In the PdfViewer component, a Cross-Site Scripting (XSS) vulnerability is possible if a specially-crafted document has already been loaded and the user engages with a tool that requires the DOM to be re-rendered."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-63",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-63 Cross-Site Scripting (XSS)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-02T14:39:15.442Z",
        "orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
        "shortName": "ProgressSoftware"
      },
      "references": [
        {
          "url": "https://www.telerik.com/blazor-ui/documentation/knowledge-base/pdfviewer-xss-vulnerability-cve-2025-6725"
        },
        {
          "url": "https://www.telerik.com/aspnet-core-ui/documentation/knowledge-base/kb-security-pdfviewer-xss-cve-2025-6725"
        },
        {
          "url": "https://www.telerik.com/aspnet-mvc/documentation/knowledge-base/kb-security-pdfviewer-xss-cve-2025-6725"
        },
        {
          "url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-pdfviewer-xss-cve-2025-6725"
        },
        {
          "url": "https://www.telerik.com/kendo-angular-ui/components/knowledge-base/kb-security-pdfviewer-xss-cve-2025-6725"
        },
        {
          "url": "https://www.telerik.com/kendo-react-ui/components/knowledge-base/kb-security-pdfviewer-xss-cve-2025-6725"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Cross-Site Scripting (XSS) in PdfViewer",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
    "assignerShortName": "ProgressSoftware",
    "cveId": "CVE-2025-6725",
    "datePublished": "2025-07-02T14:39:15.442Z",
    "dateReserved": "2025-06-26T14:27:40.423Z",
    "dateUpdated": "2025-07-02T14:54:14.971Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Find a vulnerability

Search criteria

6 vulnerabilities found for Telerik UI for ASP.NET Core by Progress Software

CVE-2026-106154 (GCVE-0-2026-106154)

CVE-2026-106156 (GCVE-0-2026-106156)

CVE-2025-6725 (GCVE-0-2025-6725)

CVE-2026-106154 (GCVE-0-2026-106154)

CVE-2026-106156 (GCVE-0-2026-106156)

CVE-2025-6725 (GCVE-0-2025-6725)