CVE-2026-124686

In Progress® Kendo® UI for jQuery versions prior to 2026.4.1111, kendo.init compiles data- attribute values with new Function when an invalid JSON object is supplied. An attacker with low privileges who can control these attribute values can inject JavaScript that executes during declarative widg...