CVE-2026-124686

Progress Kendo UI for jQuery versions prior to 2026.4.1111 are vulnerable to a JavaScript Code Injection via the kendo.init() function. The root cause is that the function compiles data-* attribute values using new Function when an invalid JSON object is provided. An attacker with low privileges ...