Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 407

Export CSV
CVE-2026-124697

Cross-Site Scripting in Kendo UI for jQuery Chart Shared Tooltip

In Progress Kendo UI for jQuery, Chart shared-tooltip rendering treats bound category and series-name values as raw HTML. An attacker who can influence values consumed by an affected Chart can inject markup that executes as JavaScript when a user displays the shared tooltip. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. Version 2016.2.607 or earlier may be affected, but earlier releases have not been verified. The latest vulnerable version is 2026.3.1015; the issue is fixed in version 2026.4.1111.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed
Vendors
Progress
Products
Kendo Ui For Jquery
CVE-2026-124691

Cross-Site Scripting in Kendo UI for jQuery Gantt Parent Dropdown

In Progress Kendo UI for jQuery Gantt, the task editor's Parent dropdown renders task titles as HTML. An attacker who can influence a task title shown in the dropdown can cause attacker-controlled markup to execute as JavaScript when a user opens or interacts with the task editor. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected version is 2020.3.915; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed
Vendors
Progress
Products
Kendo Ui For Jquery
CVE-2026-124695

Cross-Site Scripting in Kendo UI for jQuery Form Item Hints

In Progress Kendo UI for jQuery Form, the items[].hint option is documented as a string but is rendered as HTML. An attacker who can influence a Form item's hint can cause attacker-controlled markup to execute as JavaScript when a user views the rendered form. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected version is 2020.2.513; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed
Vendors
Progress
Products
Kendo Ui For Jquery
CVE-2026-124696

Cross-Site Scripting in Kendo UI for jQuery Spreadsheet Sheet Names

In Progress Kendo UI for jQuery, Spreadsheet sheet names are inserted into the SheetsBar menu button's data-sheet-name attribute without encoding. An attacker who can influence a sheet name can inject an event-handler attribute and execute JavaScript when a user hovers over the menu button. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected version is 2024.4.1112; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed
Vendors
Progress
Products
Kendo Ui For Jquery
CVE-2026-124698

Cross-Site Scripting in Kendo UI for jQuery Chart Shared Tooltip

In Progress Kendo UI for jQuery, the Chart default tooltip renders point values as raw HTML. An attacker who can influence a string point value can inject markup that executes as JavaScript when a user hovers over the point. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. Version 2016.2.607 or earlier may be affected, but earlier releases have not been verified. The latest vulnerable version is 2026.3.1015; the issue is fixed in version 2026.4.1111.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed
Vendors
Progress
Products
Kendo Ui For Jquery
CVE-2026-106146

Uncaught Exceptions in Telerik UI for ASP.NET MVC Filter Processing

In Progress® Telerik® UI for ASP.NET MVC versions `2012.2.710` through `2026.3.1015`, server-side filter processing does not properly validate descriptor types, null values, or stack state in FilterNodeVisitor and does not catch FilterParserException within the affected assembly. An unauthenticated remote attacker can exploit this if the application exposes an endpoint reachable without authentication that accepts crafted filter parameters. Affected requests can trigger uncaught cast, null-reference, or empty-stack exceptions and return HTTP 500. The report does not demonstrate worker-process termination or disruption of unrelated requests. The issue is fixed in version `2026.4.1111`.

CVSS 3.1 · 8.6 High EPSS n/a KEV · Not listed
Vendors
Progress
Products
Telerik Ui For Asp.net Mvc
CVE-2026-124700

URL Redirection to Untrusted Site in Progress Telerik UI for WinForms

In Telerik UI for WinForms, versions prior to 2026.4.1111, an untrusted URL redirection vulnerability exists that allows an attacker to launch arbitrary operating system protocol handlers with attacker-controlled arguments via crafted documents and hyperlinks with a non-allowlisted URI scheme that the user opens.

CVSS 3.1 · 7.8 High EPSS n/a KEV · Not listed
Vendors
Progress
Products
Telerik Ui For Winforms
CVE-2026-106154

Uncontrolled Recursion in Telerik UI for ASP.NET Core FilterParser

In Progress® Telerik® UI for ASP.NET Core versions `2015.1.318` through `2026.3.1015`, the server-side FilterParser processes nested expressions in untrusted filter parameters through recursive parsing without a recursion-depth limit, while FilterLexer does not enforce an input-length limit. An unauthenticated remote attacker can exploit this if the application exposes an endpoint using DataSourceRequest model binding that is reachable without authentication. Deeply nested filters can trigger parsing errors during model binding or cause `StackOverflowException`. This issue is fixed in version `2026.4.1111`.

CVSS 3.1 · 8.6 High EPSS n/a KEV · Not listed
Vendors
Progress
Products
Telerik Ui For Asp.net Core
CVE-2026-124690

Cross-Site Scripting During Kendo UI for jQuery Custom SVG Icon Sanitization

In Progress Kendo UI for jQuery, sanitizeSvgContent() parses custom icon markup into a live DOM before filtering it. An attacker who can influence custom icon content can cause JavaScript to execute during icon creation, before an unsafe element is removed. The issue was reported in version 2026.3.1015; the first affected release has not been established. The issue is fixed in version 2026.4.1110.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Kendo Ui For Jquery
CVE-2026-124701

Deserialization of Untrusted Data in Progress Telerik UI for WinForms

In Telerik UI for WinForms, versions prior to 2026.4.1111, a deserialization of untrusted data vulnerability exists that allows an attacker to perform unauthorized actions in the context of the affected application.

CVSS 3.1 · 7.8 High EPSS n/a KEV · Not listed
Vendors
Progress
Products
Telerik Ui For Winforms
CVE-2026-106156

Uncontrolled Resource Consumption in Telerik UI for ASP.NET Core Server-side Aggregation

In Progress® Telerik® UI for ASP.NET Core versions `2015.1.318` through `2026.3.811`, repeated server-side aggregation requests, with or without grouping, cause dynamic assemblies and load contexts to be retained, resulting in accumulating process memory consumption. An unauthenticated remote attacker can exploit this if the application exposes an aggregation endpoint that is reachable without authentication. Repeated requests can cause memory growth that may exhaust available resources and affect application availability. Disabling grouping in the client-side interface does not prevent direct requests containing these descriptors. The issue is fixed in version `2026.3.1015`.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Telerik Ui For Asp.net Core
CVE-2026-106137

ClassFactory Race Condition and Retained Assembly Memory in Telerik UI for ASP.NET MVC

In affected versions of Progress® Telerik® UI for ASP.NET MVC `2012.2.710` through `2026.3.811`, ClassFactory updates a shared class dictionary without exclusive write protection and emits non-collectible dynamic assemblies that remain loaded for the AppDomain's lifetime. The dictionary lookup and insertion are not atomic, and case variations in aggregate descriptors can produce distinct retained types even though member resolution is case-insensitive. An unauthenticated remote attacker can exploit this if the application exposes an aggregation endpoint that is reachable without authentication, by submitting concurrent or repeated crafted requests. These requests may corrupt dictionary state or increase CPU and memory use, potentially degrading availability. The issue is fixed in version `2026.3.1015`.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Telerik Ui For Asp.net Mvc
CVE-2026-124699

Improper Control of Generation of Code in Progress Telerik UI for WinForms

In Telerik UI for WinForms, versions prior to 2026.4.1111, an improper control of code generation vulnerability exists that allows an attacker to supply a crafted expression and execute unauthorized code in the context of the affected application.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Telerik Ui For Winforms
CVE-2026-124686

JavaScript Code Injection through kendo.init() in Kendo UI for jQuery

In Progress® Kendo® UI for jQuery versions prior to 2026.4.1111, kendo.init() compiles data-* attribute values with new Function when an invalid JSON object is supplied. An attacker with low privileges who can control these attribute values can inject JavaScript that executes during declarative widget initialization when a user loads or interacts with an affected page. Successful exploitation can compromise the confidentiality and integrity of data accessible in the user's browser context. The issue was reported in version 2022.3.1109; the first affected release has not been established.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Kendo Ui For Jquery
CVE-2026-124687

Cross-Site Scripting in DropDownButton and SplitButton Items in Kendo UI for jQuery

In Progress® Kendo® UI for jQuery versions from 2022.2.621 prior to 2026.4.1111 the DropDownButton and SplitButton allow markup injection through the `id` and `target` attributes. An attacker who can influence these item values can break out of the attributes and inject markup, including event handlers. The issue is fixed in 2026.4.1111.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Kendo Ui For Jquery
CVE-2026-124688

Cross-Site Scripting via the spriteCssClass Field in Kendo UI for jQuery

In Progress® Kendo® UI for jQuery prior to 2026.4.1111 the TabStrip, PanelBar, and Menu widgets support mapping a dataSource field to `spriteCssClass`. If an attacker can control the mapped data, they can break out of the attribute and inject markup, including event-handler attributes. The resulting JavaScript executes in the application's origin when a victim loads a page that renders the affected widget, allowing access to data and actions available in the victim's authenticated session.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Kendo Ui For Jquery
CVE-2026-124689

Cross-Site Scripting in Kendo UI for jQuery ActionSheet Header Labels

In Progress Kendo UI for jQuery versions 2026.3.1014 up to, but not including, 2026.4.1110, ActionSheet does not encode title, subtitle, and header button label values before rendering them. An attacker who can influence these values can inject markup that executes as JavaScript when a user opens the ActionSheet. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The report identifies version 2026.3.1014; the first affected release has not been established.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Kendo Ui For Jquery
CVE-2026-124692

Cross-Site Scripting in Kendo UI for jQuery Grid and TreeList Column Reordering

In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, the Grid and TreeList column-reorder drag clue reparses header text as HTML. An attacker who can influence a column field or title used by an affected application can cause JavaScript to execute when a user drags a column header while column reordering is enabled. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected release has not been established.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Kendo Ui For Jquery
CVE-2026-124693

Cross-Site Scripting in Kendo UI for jQuery PivotGrid Axis Chips

In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PivotGrid and PivotConfigurator axis field names are passed to a chip template without appropriate encoding. An attacker who can influence an axis field name can cause JavaScript to execute when a user views the rendered chip. The field name can be interpreted as HTML in both attribute and element contexts. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected release has not been established.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Kendo Ui For Jquery
CVE-2026-124694

Cross-Site Scripting in Kendo UI for jQuery PropertyGrid Values and Descriptions

In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PropertyGrid does not encode bound property values and items[].description in its default configuration. An attacker who can influence either value can cause JavaScript to execute when a user views the grid. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected release has not been established.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Kendo Ui For Jquery