75449 matches found
CVE-2026-106157
The Kendo UI for jQuery component (versions 2019.2.514 to 2026.3.1015 ) is vulnerable to Cross-Site Scripting (XSS) via the PanelBar component. The root cause is the lack of proper encoding when inserting data source item URL values into a single-quoted href attribute. An attacker capable of cont...
EUVD-2026-102081
In Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar component inserts data source item URL values into a single-quoted href attribute without proper encoding. An attacker who can control an item URL can inject additional HTML attributes,...
CVE-2026-106162
The Kendo UI for jQuery component, specifically the FileManager component, is vulnerable to Cross-Site Scripting (XSS) in versions 2023.3.1010 through 2026.3.1015 . The root cause is that the component renders remotely supplied item names as HTML within its default drag hint , even though list it...
CVE-2026-106162
In Progress® Kendo® UI for jQuery versions starting with 2023.3.1010 and prior to 2026.3.1015, the FileManager component renders remotely supplied item names as HTML in its default drag hint even though the corresponding list items are encoded. An attacker who can control an item name can inject...
CVE-2026-106163
Progress Kendo UI for jQuery versions from v2023.1.117 up to v2026.3.1015 are vulnerable to Cross-site Scripting (XSS) . The FileBrowser and ImageBrowser components fail to properly encode remotely supplied file and directory names when rendering them as HTML. An attacker can provide a name conta...
CVE-2026-106163
In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components render remotely supplied file and directory names as HTML without proper encoding. An attacker-controlled name containing script-related HTML can execute...
EUVD-2026-102056
In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components render remotely supplied file and directory names as HTML without proper encoding. An attacker-controlled name containing script-related HTML can execute...
CVE-2026-106163 Cross-site Scripting (XSS) in Kendo UI for jQuery FileBrowser and ImageBrowser
In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components render remotely supplied file and directory names as HTML without proper encoding. An attacker-controlled name containing script-related HTML can execute...
CVE-2026-106163 Cross-site Scripting (XSS) in Kendo UI for jQuery FileBrowser and ImageBrowser
In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components render remotely supplied file and directory names as HTML without proper encoding. An attacker-controlled name containing script-related HTML can execute...
firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript Engine: JIT component...
CLEANSTART-2026-NE60365 When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression
CVE-2026-94448 affects multiple packages. When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. See references for individual vulnerability details...
PT-2026-114941
In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string concatenation without proper neutralization. An attacker with low privileges who can control these fields can inject JavaScript event-handler attributes th...
CVE-2026-106149: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string concatenation without proper neutralization. An attacker with low privileges who can control these fields can inject JavaScript event-handler attributes th...
PT-2026-114928
In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components render remotely supplied file and directory names as HTML without proper encoding. An attacker-controlled name containing script-related HTML can execute...
CVE-2026-106163: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components render remotely supplied file and directory names as HTML without proper encoding. An attacker-controlled name containing script-related HTML can execute...
PT-2026-114936
In Progress® Kendo® UI for jQuery versions starting with 2022.3.1109 and prior to 2026.3.1015, ToolBar ButtonGroup button URLs are concatenated into an unquoted href attribute after URL sanitization. An attacker who can control a button URL can supply an otherwise allowed HTTPS URL containing...
CVE-2026-106158: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
In Progress® Kendo® UI for jQuery, in v2026.3.811 and earlier, the Scheduler Day, Timeline, Month, and Agenda views insert resource color values into quoted event wrapper attributes without proper encoding. An attacker who can control a resource color can inject additional HTML attributes,...
UBUNTU-CVE-2026-101019
Description NGINX JavaScript njs has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an...
CVE-2026-59994: Improper Neutralization of Input During Web Page Generation
EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an unauthenticated remote attacker can send an email to a monitored group or IMAP address, including an email-to-Case address, and place arbitrary HTML in its plain-text body. EspoCRM stores that body and...
UBUNTU-CVE-2026-101025
Description NGINX JavaScript njs has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse fails. The failure path did not register cleanup and the context was not released for the lifetime of the process. An unauthenticated attacker may send requests with...