CVE-2026-106157 Cross-Site Scripting via PanelBar Item URLs in Kendo UI for jQuery

In Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar component inserts data source item URL values into a single-quoted href attribute without proper encoding. An attacker who can control an item URL can inject additional HTML attributes,...

CVE-2026-106157 Cross-Site Scripting via PanelBar Item URLs in Kendo UI for jQuery

In Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar component inserts data source item URL values into a single-quoted href attribute without proper encoding. An attacker who can control an item URL can inject additional HTML attributes,...

CVE-2026-106157

In Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar component inserts data source item URL values into a single-quoted href attribute without proper encoding. An attacker who can control an item URL can inject additional HTML attributes,...

PT-2026-114934

In Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar component inserts data source item URL values into a single-quoted href attribute without proper encoding. An attacker who can control an item URL can inject additional HTML attributes,...

CVE-2026-88782 Kubio AI Page Builder < 2.9.3 - Contributor+ Stored XSS via Image Gallery Item URL Attribute

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link target, allowing users with the contributor role and above to store a payload which executes in the browser of anyone who follows the link, including an...

PT-2017-13836

Name of the Vulnerable Software and Affected Versions TeamPass versions prior to 2.1.27.9 Description The issue allows authenticated remote attackers to inject arbitrary web script or HTML. This can be achieved via the URL value of an item or user log history. To exploit, the attacker must first ...