CVE-2026-124693

The Kendo UI for jQuery component (versions 2026.3.1015 up to but not including 2026.4.1110 ) contains a Cross-Site Scripting (XSS) vulnerability in the PivotGrid and PivotConfigurator components. The root cause is the lack of appropriate encoding when axis field names are passed to a chip templa...

EUVD-2026-123602

In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PivotGrid and PivotConfigurator axis field names are passed to a chip template without appropriate encoding. An attacker who can influence an axis field name can cause JavaScript to execute when a user vie...