CVE-2026-108116

In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection...

CVE-2026-106153

In Progress® Kendo® UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar month content templates render data.url and data.title without proper URL sanitization and HTML attribute encoding. An attacker with low privileges who can control the URL option or culture-derived...

CVE-2026-106151

In Progress® Kendo® UI for jQuery versions starting with 2012.2.710 and prior to 2026.3.1015, the Validator decodes validation messages from data-msg- attributes and parses the resulting text as HTML. An attacker who can modify a validation message can cause HTML that was correctly escaped in the...

CVE-2026-106150

In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the Splitter and Window components starting with version 2011.2.804 and the Tooltip component starting with version 2013.1.319 construct iframe markup without properly sanitizing URL values or encoding the Window iframe title. An attacker wi...

CVE-2026-106149

In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string concatenation without proper neutralization. An attacker with low privileges who can control these fields can inject JavaScript event-handler attributes th...

CVE-2026-106148

The Kendo UI for jQuery components TabStrip , Menu , and PanelBar are vulnerable to Cross-Site Scripting (XSS) in versions prior to 2026.3.1015 . The root cause is the lack of proper escaping when inserting data source imageUrl values into single-quoted image src attributes. An attacker capable o...

CVE-2026-106148 Cross-Site Scripting via TabStrip, Menu, and PanelBar Image URLs in Kendo UI for jQuery

In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the TabStrip, Menu, and PanelBar components insert data source imageUrl values into single-quoted image src attributes without proper escaping. An attacker who can modify an image URL can inject additional HTML attributes, including event...

CVE-2026-106147

Progress Kendo UI for jQuery releases from R1 2020 up to (but not including) 2026.3.1015 are vulnerable to Cross-Site Scripting (XSS) . The root cause is that the ListBox default item template renders the bound dataTextField value as raw HTML without proper encoding. An attacker capable of modify...

CVE-2026-106161

Progress Kendo UI for jQuery releases from v2020.1.114 up to (but not including) v2026.3.1015 are vulnerable to Cross-Site Scripting (XSS) . The Badge text method fails to encode string values, rendering them as raw HTML even when supplied through text binding. An attacker capable of modifying bo...

CVE-2026-106160

Progress Kendo UI for jQuery versions prior to 2026.3.1015 are vulnerable to Prototype Pollution via Model.accept and kendo.setter. The root cause is a failure to guard against unsafe object paths containing __proto__, constructor, or prototype when processing server-response keys. An attacker pr...

CVE-2026-106159

Progress Kendo UI for jQuery versions from 2022.3.1109 up to (but not including) 2026.3.1015 are vulnerable to a Cross-Site Scripting (XSS) flaw in the ToolBar ButtonGroup component. The root cause is the concatenation of button URLs into an unquoted href attribute following URL sanitization. An ...

CVE-2026-106158

Progress Kendo UI for jQuery (v2026.3.811 and earlier) is vulnerable to Cross-Site Scripting (XSS) in the Scheduler Day, Timeline, Month, and Agenda views. The root cause is the improper encoding of resource color values when they are inserted into quoted event wrapper attributes. An attacker cap...

CVE-2026-106157

The Kendo UI for jQuery component (versions 2019.2.514 to 2026.3.1015 ) is vulnerable to Cross-Site Scripting (XSS) via the PanelBar component. The root cause is the lack of proper encoding when inserting data source item URL values into a single-quoted href attribute. An attacker capable of cont...

CVE-2026-106162

The Kendo UI for jQuery component, specifically the FileManager component, is vulnerable to Cross-Site Scripting (XSS) in versions 2023.3.1010 through 2026.3.1015 . The root cause is that the component renders remotely supplied item names as HTML within its default drag hint , even though list it...

CVE-2026-106163

Progress Kendo UI for jQuery versions from v2023.1.117 up to v2026.3.1015 are vulnerable to Cross-site Scripting (XSS) . The FileBrowser and ImageBrowser components fail to properly encode remotely supplied file and directory names when rendering them as HTML. An attacker can provide a name conta...