CVE-2026-106147 Cross-Site Scripting via ListBox Bound Text in Kendo UI for jQuery

In Progress® Kendo® UI for jQuery releases starting with R1 2020 and prior to 2026.3.1015, the ListBox default item template renders the bound dataTextField value as raw HTML without encoding. An attacker who can modify the bound data can supply HTML containing event handlers that execute...

CVE-2026-106147

Progress Kendo UI for jQuery releases from R1 2020 up to (but not including) 2026.3.1015 are vulnerable to Cross-Site Scripting (XSS) . The root cause is that the ListBox default item template renders the bound dataTextField value as raw HTML without proper encoding. An attacker capable of modify...

EUVD-2026-102085

In Progress® Kendo® UI for jQuery releases starting with v2020.1.114 and prior to 2026.3.1015, the Badge text method renders string values as raw HTML without encoding, including values supplied through text binding. An attacker who can modify data bound to a Badge can supply HTML containing even...

CVE-2026-106161 Cross-Site Scripting via Badge Text Binding in Kendo UI for jQuery

In Progress® Kendo® UI for jQuery releases starting with v2020.1.114 and prior to 2026.3.1015, the Badge text method renders string values as raw HTML without encoding, including values supplied through text binding. An attacker who can modify data bound to a Badge can supply HTML containing even...

CVE-2026-106161

Progress Kendo UI for jQuery releases from v2020.1.114 up to (but not including) v2026.3.1015 are vulnerable to Cross-Site Scripting (XSS) . The Badge text method fails to encode string values, rendering them as raw HTML even when supplied through text binding. An attacker capable of modifying bo...

EUVD-2026-102084

In Progress® Kendo® UI for jQuery prior to 2026.3.1015, Model.accept passes server-response keys to kendo.setter without guarding against unsafe object paths containing proto, constructor, or prototype. An attacker who can supply data accepted by an affected model can modify object prototype...

CVE-2026-106160 Prototype Pollution via Model.accept and kendo.setter in Kendo UI for jQuery

In Progress® Kendo® UI for jQuery prior to 2026.3.1015, Model.accept passes server-response keys to kendo.setter without guarding against unsafe object paths containing proto, constructor, or prototype. An attacker who can supply data accepted by an affected model can modify object prototype...

CVE-2026-106160

Progress Kendo UI for jQuery versions prior to 2026.3.1015 are vulnerable to Prototype Pollution via Model.accept and kendo.setter. The root cause is a failure to guard against unsafe object paths containing __proto__, constructor, or prototype when processing server-response keys. An attacker pr...

cve-2023-20198-poc-cisco

CVE-2023-20198-poc CVE-2023-20198 is a critical vulnerability in the Cisco IOS XE software Web UI feature that allows unauthenticated remote attackers to create accounts with privilege level 15 on affected systems, thereby gaining full control of the device. The vulnerability primarily stems from...

CVE-2026-106159 Cross-Site Scripting via ToolBar ButtonGroup URLs in Kendo UI for jQuery

In Progress® Kendo® UI for jQuery versions starting with 2022.3.1109 and prior to 2026.3.1015, ToolBar ButtonGroup button URLs are concatenated into an unquoted href attribute after URL sanitization. An attacker who can control a button URL can supply an otherwise allowed HTTPS URL containing...

EUVD-2026-102083

In Progress® Kendo® UI for jQuery versions starting with 2022.3.1109 and prior to 2026.3.1015, ToolBar ButtonGroup button URLs are concatenated into an unquoted href attribute after URL sanitization. An attacker who can control a button URL can supply an otherwise allowed HTTPS URL containing...

CVE-2026-106159

Progress Kendo UI for jQuery versions from 2022.3.1109 up to (but not including) 2026.3.1015 are vulnerable to a Cross-Site Scripting (XSS) flaw in the ToolBar ButtonGroup component. The root cause is the concatenation of button URLs into an unquoted href attribute following URL sanitization. An ...

EUVD-2026-102082

In Progress® Kendo® UI for jQuery, in v2026.3.811 and earlier, the Scheduler Day, Timeline, Month, and Agenda views insert resource color values into quoted event wrapper attributes without proper encoding. An attacker who can control a resource color can inject additional HTML attributes,...

CVE-2026-106158

Progress Kendo UI for jQuery (v2026.3.811 and earlier) is vulnerable to Cross-Site Scripting (XSS) in the Scheduler Day, Timeline, Month, and Agenda views. The root cause is the improper encoding of resource color values when they are inserted into quoted event wrapper attributes. An attacker cap...

CVE-2026-106158 Cross-Site Scripting via Scheduler Resource Colors in Kendo UI for jQuery

In Progress® Kendo® UI for jQuery, in v2026.3.811 and earlier, the Scheduler Day, Timeline, Month, and Agenda views insert resource color values into quoted event wrapper attributes without proper encoding. An attacker who can control a resource color can inject additional HTML attributes,...

CVE-2026-106157 Cross-Site Scripting via PanelBar Item URLs in Kendo UI for jQuery

In Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar component inserts data source item URL values into a single-quoted href attribute without proper encoding. An attacker who can control an item URL can inject additional HTML attributes,...

EUVD-2026-102081

In Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar component inserts data source item URL values into a single-quoted href attribute without proper encoding. An attacker who can control an item URL can inject additional HTML attributes,...

CVE-2026-106157

The Kendo UI for jQuery component (versions 2019.2.514 to 2026.3.1015 ) is vulnerable to Cross-Site Scripting (XSS) via the PanelBar component. The root cause is the lack of proper encoding when inserting data source item URL values into a single-quoted href attribute. An attacker capable of cont...

CVE-2026-106162 Cross-Site Scripting in FileManager Drag Hints in Kendo UI for jQuery

In Progress® Kendo® UI for jQuery versions starting with 2023.3.1010 and prior to 2026.3.1015, the FileManager component renders remotely supplied item names as HTML in its default drag hint even though the corresponding list items are encoded. An attacker who can control an item name can inject...

EUVD-2026-102057

In Progress® Kendo® UI for jQuery versions starting with 2023.3.1010 and prior to 2026.3.1015, the FileManager component renders remotely supplied item names as HTML in its default drag hint even though the corresponding list items are encoded. An attacker who can control an item name can inject...