CVE-2026-55184

The open source customer relationship management application EspoCRM is vulnerable to Stored XSS in wysiwyg template fields prior to version 9.3.9 . A user with permissions to edit Email Templates or PDF Templates can inject crafted HTML that bypasses the moderateSanitizeHtml() function. If anoth...

CVE-2026-53575 EspoCRM: Persistent XSS via CSP nonce injection in applicationName setting by admin user

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an authenticated administrator can place crafted content in the applicationName setting through CSP nonce injection. The persistent injection is inserted into the main application page without escaping, allowi...

CVE-2026-53575 EspoCRM: Persistent XSS via CSP nonce injection in applicationName setting by admin user

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an authenticated administrator can place crafted content in the applicationName setting through CSP nonce injection. The persistent injection is inserted into the main application page without escaping, allowi...

CVE-2026-53575

The open source customer relationship management application EspoCRM is vulnerable to a Persistent Cross-Site Scripting (XSS) flaw in versions prior to 9.3.9 . An authenticated administrator can inject crafted content into the applicationName setting using a CSP nonce injection . Because this inp...

CVE-2026-53575 EspoCRM: Persistent XSS via CSP nonce injection in applicationName setting by admin user

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an authenticated administrator can place crafted content in the applicationName setting through CSP nonce injection. The persistent injection is inserted into the main application page without escaping, allowi...

WordPress Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin <= 5.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Athiwat Tiprasaharn Jitlada, Itthidej Aramsri Boeing777, Suphakit Phrmduang TORTY in WordPress Plugin WP Dark Mode versions = 5.3.17...

CVE-2026-106163

In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components render remotely supplied file and directory names as HTML without proper encoding. An attacker-controlled name containing script-related HTML can execute...

CVE-2026-106158

In Progress® Kendo® UI for jQuery, in v2026.3.811 and earlier, the Scheduler Day, Timeline, Month, and Agenda views insert resource color values into quoted event wrapper attributes without proper encoding. An attacker who can control a resource color can inject additional HTML attributes,...

CVE-2026-106148

In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the TabStrip, Menu, and PanelBar components insert data source imageUrl values into single-quoted image src attributes without proper escaping. An attacker who can modify an image URL can inject additional HTML attributes, including event...

CVE-2026-106159

In Progress® Kendo® UI for jQuery versions starting with 2022.3.1109 and prior to 2026.3.1015, ToolBar ButtonGroup button URLs are concatenated into an unquoted href attribute after URL sanitization. An attacker who can control a button URL can supply an otherwise allowed HTTPS URL containing...

CVE-2026-106161

In Progress® Kendo® UI for jQuery releases starting with v2020.1.114 and prior to 2026.3.1015, the Badge text method renders string values as raw HTML without encoding, including values supplied through text binding. An attacker who can modify data bound to a Badge can supply HTML containing even...

CVE-2026-106162

In Progress® Kendo® UI for jQuery versions starting with 2023.3.1010 and prior to 2026.3.1015, the FileManager component renders remotely supplied item names as HTML in its default drag hint even though the corresponding list items are encoded. An attacker who can control an item name can inject...

CVE-2026-106147

In Progress® Kendo® UI for jQuery releases starting with R1 2020 and prior to 2026.3.1015, the ListBox default item template renders the bound dataTextField value as raw HTML without encoding. An attacker who can modify the bound data can supply HTML containing event handlers that execute...

CVE-2026-106157

In Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar component inserts data source item URL values into a single-quoted href attribute without proper encoding. An attacker who can control an item URL can inject additional HTML attributes,...

CVE-2026-106153 Cross-site Scripting (XSS) in Kendo UI for jQuery Calendar and MultiViewCalendar

In Progress® Kendo® UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar month content templates render data.url and data.title without proper URL sanitization and HTML attribute encoding. An attacker with low privileges who can control the URL option or culture-derived...

CVE-2026-106153 Cross-site Scripting (XSS) in Kendo UI for jQuery Calendar and MultiViewCalendar

In Progress® Kendo® UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar month content templates render data.url and data.title without proper URL sanitization and HTML attribute encoding. An attacker with low privileges who can control the URL option or culture-derived...

CVE-2026-106153

In Progress® Kendo® UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar month content templates render data.url and data.title without proper URL sanitization and HTML attribute encoding. An attacker with low privileges who can control the URL option or culture-derived...

EUVD-2026-102079

In Progress® Kendo® UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar month content templates render data.url and data.title without proper URL sanitization and HTML attribute encoding. An attacker with low privileges who can control the URL option or culture-derived...

CVE-2026-106153

Progress Kendo UI for jQuery prior to version 2026.3.1015 is vulnerable to Cross-site Scripting (XSS) in the Calendar and MultiViewCalendar components. The root cause is the lack of proper URL sanitization and HTML attribute encoding when rendering data.url and data.title in month content templat...

CVE-2026-106151 Cross-Site Scripting in Validator Validation Messages in Kendo UI for jQuery

In Progress® Kendo® UI for jQuery versions starting with 2012.2.710 and prior to 2026.3.1015, the Validator decodes validation messages from data-msg- attributes and parses the resulting text as HTML. An attacker who can modify a validation message can cause HTML that was correctly escaped in the...