CVE-2026-124691

Cross-Site Scripting in Kendo UI for jQuery Gantt Parent Dropdown

In Progress Kendo UI for jQuery Gantt, the task editor's Parent dropdown renders task titles as HTML. An attacker who can influence a task title shown in the dropdown can cause attacker-controlled markup to execute as JavaScript when a user opens or interacts with the task editor. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected version is 2020.3.915; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Progress

Products

Kendo Ui For Jquery

CVE-2026-124695

Cross-Site Scripting in Kendo UI for jQuery Form Item Hints

In Progress Kendo UI for jQuery Form, the items[].hint option is documented as a string but is rendered as HTML. An attacker who can influence a Form item's hint can cause attacker-controlled markup to execute as JavaScript when a user views the rendered form. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected version is 2020.2.513; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Progress

Products

Kendo Ui For Jquery

CVE-2026-124696

Cross-Site Scripting in Kendo UI for jQuery Spreadsheet Sheet Names

In Progress Kendo UI for jQuery, Spreadsheet sheet names are inserted into the SheetsBar menu button's data-sheet-name attribute without encoding. An attacker who can influence a sheet name can inject an event-handler attribute and execute JavaScript when a user hovers over the menu button. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected version is 2024.4.1112; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Progress

Products

Kendo Ui For Jquery

CVE-2026-124698

Cross-Site Scripting in Kendo UI for jQuery Chart Shared Tooltip

In Progress Kendo UI for jQuery, the Chart default tooltip renders point values as raw HTML. An attacker who can influence a string point value can inject markup that executes as JavaScript when a user hovers over the point. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. Version 2016.2.607 or earlier may be affected, but earlier releases have not been verified. The latest vulnerable version is 2026.3.1015; the issue is fixed in version 2026.4.1111.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Progress

Products

Kendo Ui For Jquery

CVE-2026-106146

Uncaught Exceptions in Telerik UI for ASP.NET MVC Filter Processing

In Progress® Telerik® UI for ASP.NET MVC versions `2012.2.710` through `2026.3.1015`, server-side filter processing does not properly validate descriptor types, null values, or stack state in FilterNodeVisitor and does not catch FilterParserException within the affected assembly. An unauthenticated remote attacker can exploit this if the application exposes an endpoint reachable without authentication that accepts crafted filter parameters. Affected requests can trigger uncaught cast, null-reference, or empty-stack exceptions and return HTTP 500. The report does not demonstrate worker-process termination or disruption of unrelated requests. The issue is fixed in version `2026.4.1111`.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Progress

Products

Telerik Ui For Asp.net Mvc

CVE-2026-124700

URL Redirection to Untrusted Site in Progress Telerik UI for WinForms

In Telerik UI for WinForms, versions prior to 2026.4.1111, an untrusted URL redirection vulnerability exists that allows an attacker to launch arbitrary operating system protocol handlers with attacker-controlled arguments via crafted documents and hyperlinks with a non-allowlisted URI scheme that the user opens.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Progress

Products

Telerik Ui For Winforms

CVE-2026-116316

PostgreSQL security-restricted operations can create types in pg_temp, which later queries of the session find

Improper protection of alternate path in PostgreSQL security-restricted operations allows an object creator to execute arbitrary SQL as the operation's caller, via a domain, enum, or range type created in pg_temp. The victim session must later run a query containing an unqualified type name, e.g. "SELECT '1'::bigint"; autovacuum and other common security-restricted operation users do not do so, so they are unaffected. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-116317

PostgreSQL ts_rank_cd() heap buffer overflow may execute arbitrary code

Heap-based buffer overflow in PostgreSQL ts_rank_cd() may allow a database user to execute arbitrary code as the operating system user running the database, via an invalid tsvector containing duplicate positions. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-116318

PostgreSQL pg_dump not-null constraint name allows SQL injection

SQL injection in PostgreSQL pg_dump allows an object creator to execute arbitrary SQL as the user restoring the dump, via an inherited column having a child-local not-null constraint whose name requires quoting. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-116319

PostgreSQL plperl reentrant return_next() use-after-free executes arbitrary code

Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via reentrant return_next() calls. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-116320

PostgreSQL plperl array and hash conversion use-after-free executes arbitrary code

Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via dropping the final reference to a Perl array or hash while PostgreSQL is converting that object. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-116323

PostgreSQL pltcl reentrant result conversion use-after-free executes arbitrary code

Use after free in PostgreSQL pltcl allows an object creator to execute arbitrary code as the operating system user running the database, via a domain CHECK that re-enters the Tcl interpreter and frees or changes a string still used by the outer result conversion. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-116326

PostgreSQL plperl tied-object exceptions follow stale sigjmp_buf

Uncaught exceptions in PostgreSQL plperl allow an object creator to cause use of a stale sigjmp_buf, via a tied Perl object, or a Perl object whose overloaded conversion throws while plperl is handling another error. We have not ruled out arbitrary code execution on some platform. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-116328

PostgreSQL generation memory context integer wraparound executes arbitrary code

Integer wraparound in PostgreSQL generation memory contexts allows a database user to execute arbitrary code as the operating system user running the database, via freeing an allocation larger than 1 GB and causing its block to be reused for smaller chunks whose back-pointer offset cannot represent that position. Within major versions 16-18, minor versions before PostgreSQL 18.7, 17.12, and 16.16 are affected. Versions before PostgreSQL 16 are unaffected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-116329

PostgreSQL statistics import type confusion executes arbitrary code

Type confusion in PostgreSQL statistics import allows a table maintainer to execute arbitrary code as the operating system user running the database, via nested SET DATA TYPE during conversion of values to import. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-116330

PostgreSQL pg_dump tar restore.sql fails to block psql command injection

Untrusted data inclusion in PostgreSQL pg_dump tar-format restore.sql allows a compromised origin server to execute arbitrary code as the client operating system account running psql, via the predictable restriction key in restore.sql. This is a gap in the fix for CVE-2025-8714. restore.sql is undocumented. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-116331

PostgreSQL min/max aggregate type confusion executes arbitrary code

Type confusion in PostgreSQL min/max aggregate optimization allows an object creator to execute arbitrary code as the operating system user running the database, via a user-defined aggregate whose SORTOP option causes the planner to treat the aggregate's input and result as the same type when they differ. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-116332

PostgreSQL portal setup use-after-free executes arbitrary code

Use after free in PostgreSQL portal setup allows an object creator to execute arbitrary code as the operating system user running the database, via running user-defined code during planning or executor startup that closes the portal currently being prepared. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-116335

PostgreSQL commutator or negator result-type confusion executes arbitrary code

Type confusion in PostgreSQL operator commutator and negator links allows an object creator to execute arbitrary code as the operating system user running the database, via linking operators having different result types or creating inconsistent reciprocal links. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-116336

PostgreSQL REINDEX CONCURRENTLY does not block DROP INDEX during index functions

Operation on a dropped index in PostgreSQL REINDEX CONCURRENTLY allows an object creator to execute arbitrary code as the operating system user running the database, via an index expression that issues DROP INDEX. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql