CVE-2026-106158

Progress Kendo UI for jQuery (v2026.3.811 and earlier) is vulnerable to Cross-Site Scripting (XSS) in the Scheduler Day, Timeline, Month, and Agenda views. The root cause is the improper encoding of resource color values when they are inserted into quoted event wrapper attributes. An attacker cap...

CVE-2026-106158 Cross-Site Scripting via Scheduler Resource Colors in Kendo UI for jQuery

In Progress® Kendo® UI for jQuery, in v2026.3.811 and earlier, the Scheduler Day, Timeline, Month, and Agenda views insert resource color values into quoted event wrapper attributes without proper encoding. An attacker who can control a resource color can inject additional HTML attributes,...

EUVD-2026-102081

In Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar component inserts data source item URL values into a single-quoted href attribute without proper encoding. An attacker who can control an item URL can inject additional HTML attributes,...

CVE-2026-106157

The Kendo UI for jQuery component (versions 2019.2.514 to 2026.3.1015 ) is vulnerable to Cross-Site Scripting (XSS) via the PanelBar component. The root cause is the lack of proper encoding when inserting data source item URL values into a single-quoted href attribute. An attacker capable of cont...

CVE-2026-106157 Cross-Site Scripting via PanelBar Item URLs in Kendo UI for jQuery

In Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar component inserts data source item URL values into a single-quoted href attribute without proper encoding. An attacker who can control an item URL can inject additional HTML attributes,...

CVE-2026-106162

The Kendo UI for jQuery component, specifically the FileManager component, is vulnerable to Cross-Site Scripting (XSS) in versions 2023.3.1010 through 2026.3.1015 . The root cause is that the component renders remotely supplied item names as HTML within its default drag hint , even though list it...

EUVD-2026-102057

In Progress® Kendo® UI for jQuery versions starting with 2023.3.1010 and prior to 2026.3.1015, the FileManager component renders remotely supplied item names as HTML in its default drag hint even though the corresponding list items are encoded. An attacker who can control an item name can inject...

CVE-2026-106162 Cross-Site Scripting in FileManager Drag Hints in Kendo UI for jQuery

In Progress® Kendo® UI for jQuery versions starting with 2023.3.1010 and prior to 2026.3.1015, the FileManager component renders remotely supplied item names as HTML in its default drag hint even though the corresponding list items are encoded. An attacker who can control an item name can inject...

CVE-2026-106163

Progress Kendo UI for jQuery versions from v2023.1.117 up to v2026.3.1015 are vulnerable to Cross-site Scripting (XSS) . The FileBrowser and ImageBrowser components fail to properly encode remotely supplied file and directory names when rendering them as HTML. An attacker can provide a name conta...

CVE-2026-106163 Cross-site Scripting (XSS) in Kendo UI for jQuery FileBrowser and ImageBrowser

In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components render remotely supplied file and directory names as HTML without proper encoding. An attacker-controlled name containing script-related HTML can execute...

EUVD-2026-102056

In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components render remotely supplied file and directory names as HTML without proper encoding. An attacker-controlled name containing script-related HTML can execute...

bbot-ui

BBOT TUI Viewer A self-contained terminal UI for browsing and analyzing BBOT scan results. Features 🚀 Zero Setup - Single self-installing file, no manual dependencies 🔴 Live Refresh - Auto-updates while scans are running with accurate status detection 🎯 Smart Status Detection - Accurately...

CVE-2019-18935

CVE-2019-18935 Nuclei Template - Bounty Submission This repository contains a complete, validated Nuclei template for detecting CVE-2019-18935 Telerik UI for ASP.NET AJAX Deserialization RCE, created for the ProjectDiscovery bounty program. 🎯 Overview CVE-2019-18935 is a critical .NET...

Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed Modules

Drupal core has a critical flaw in its Field UI module that could let an attacker run code on the site's server, and fixes were shipped on October 14 in Drupal 11.4.10, 11.3.19, and 10.6.19. An attacker cannot reach the flaw through core alone, the Drupal Security Team said in its advisory. Sever...

SwaggerUI-CVE-2018-25031

Exploit Swagger UI - CVE-2018-25031 Exploit Swagger UI - User Interface UI Misrepresentation of Critical Information CVE-2018-25031. This exploit checks whether the Swagger UI used is susceptible to exploitation of the User Interface UI Misrepresentation of Critical Information vulnerability...

PoC_CVE-2017-0807

Proof of concept of CVE-2017-0807 This is a demo application with deliberately sloppy interface for the CVE-2017-0807 reported by Efthimios Alepis and Constantinos Patsakis. The vulnerability illustrates that due to security issues in every Android version up to Nougat, an unprivileged user can...

CVE-2018-25031

CVE-2018-25031 CVE-2018-25031 exploits tests Swagger UI before 4.1.3 could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. HowTo Find the documentation endpoint a...

PYSEC-2026-4228 Indico: Cross-Site-Scripting in minutes editor

Impact There is a Cross-Site-Scripting vulnerability in the minute editor conflict UI tha's shown when concurrent edits are made to the same minutes in an event. Patches You should to update to Indico 3.3.13 as soon as possible. See the docs for instructions on how to update. Workarounds - Set...

Azure-APIM-Cross-Tenant-Signup-Bypass

Azure APIM Cross-Tenant Signup Bypass Status 01.12.2025: This vulnerability is still live and exploitable. Microsoft has not patched this issue and considers it "by design." Security Advisory GHSA-vcwf-73jp-r7mv CVE-2025-66390 Summary A security vulnerability in Azure API Management APIM Develope...

CVE-2023-32198

A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle MitM attack against services using Steve...