CVE-2026-106148

In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the TabStrip, Menu, and PanelBar components insert data source imageUrl values into single-quoted image src attributes without proper escaping. An attacker who can modify an image URL can inject additional HTML attributes, including event...

CVE-2026-106157

In Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar component inserts data source item URL values into a single-quoted href attribute without proper encoding. An attacker who can control an item URL can inject additional HTML attributes,...

CVE-2026-106148 Cross-Site Scripting via TabStrip, Menu, and PanelBar Image URLs in Kendo UI for jQuery

In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the TabStrip, Menu, and PanelBar components insert data source imageUrl values into single-quoted image src attributes without proper escaping. An attacker who can modify an image URL can inject additional HTML attributes, including event...

CVE-2026-106148

The Kendo UI for jQuery components TabStrip , Menu , and PanelBar are vulnerable to Cross-Site Scripting (XSS) in versions prior to 2026.3.1015 . The root cause is the lack of proper escaping when inserting data source imageUrl values into single-quoted image src attributes. An attacker capable o...

CVE-2026-106157

The Kendo UI for jQuery component (versions 2019.2.514 to 2026.3.1015 ) is vulnerable to Cross-Site Scripting (XSS) via the PanelBar component. The root cause is the lack of proper encoding when inserting data source item URL values into a single-quoted href attribute. An attacker capable of cont...