Progress
Progress Kendo UI FOR Jquery: vulnerabilities and CVEs
Progress Kendo UI FOR Jquery has 13 published vulnerabilities, 13 of them in the last 12 months. 0 are rated critical and 0 are listed by CISA as actively exploited.
CVEs13
Last 12 months13
Critical0
Actively exploited0
All vulnerabilities in the catalogue →⭐ Follow this technology
Latest vulnerabilities
| CVE | Severity | EPSS | Active exploitation | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-108116 | High (7.5) | — | — | Oct 15, 2026 | In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data… |
| CVE-2026-106153 | Medium (5.4) | — | — | Oct 15, 2026 | In Progress® Kendo® UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar month content templates render data.url and data.title without proper URL sanitization and HTML attribute encoding. An… |
| CVE-2026-106151 | Medium (5.4) | — | — | Oct 15, 2026 | In Progress® Kendo® UI for jQuery versions starting with 2012.2.710 and prior to 2026.3.1015, the Validator decodes validation messages from data-msg-* attributes and parses the resulting text as HTML. An attacker who… |
| CVE-2026-106149 | Medium (5.4) | — | — | Oct 15, 2026 | In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string concatenation without proper neutralization. An attacker with low privileges… |
| CVE-2026-106163 | Medium (6.5) | — | — | Oct 15, 2026 | In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components render remotely supplied file and directory names as HTML without proper… |
| CVE-2026-106162 | Medium (4.7) | — | — | Oct 15, 2026 | In Progress® Kendo® UI for jQuery versions starting with 2023.3.1010 and prior to 2026.3.1015, the FileManager component renders remotely supplied item names as HTML in its default drag hint even though the… |
| CVE-2026-106161 | Medium (5.4) | — | — | Oct 15, 2026 | In Progress® Kendo® UI for jQuery releases starting with v2020.1.114 and prior to 2026.3.1015, the Badge text method renders string values as raw HTML without encoding, including values supplied through text binding. An… |
| CVE-2026-106160 | Medium (5.4) | — | — | Oct 15, 2026 | In Progress® Kendo® UI for jQuery prior to 2026.3.1015, Model.accept passes server-response keys to kendo.setter without guarding against unsafe object paths containing __proto__, constructor, or prototype. An attacker… |
| CVE-2026-106159 | Medium (4.7) | — | — | Oct 15, 2026 | In Progress® Kendo® UI for jQuery versions starting with 2022.3.1109 and prior to 2026.3.1015, ToolBar ButtonGroup button URLs are concatenated into an unquoted href attribute after URL sanitization. An attacker who can… |
| CVE-2026-106158 | Medium (4.7) | — | — | Oct 15, 2026 | In Progress® Kendo® UI for jQuery, in v2026.3.811 and earlier, the Scheduler Day, Timeline, Month, and Agenda views insert resource color values into quoted event wrapper attributes without proper encoding. An attacker… |
| CVE-2026-106157 | Medium (4.7) | — | — | Oct 15, 2026 | In Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar component inserts data source item URL values into a single-quoted href attribute without proper encoding. An… |
| CVE-2026-106148 | Medium (5.4) | — | — | Oct 15, 2026 | In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the TabStrip, Menu, and PanelBar components insert data source imageUrl values into single-quoted image src attributes without proper escaping. An attacker who can… |
| CVE-2026-106147 | Medium (5.4) | — | — | Oct 15, 2026 | In Progress® Kendo® UI for jQuery releases starting with R1 2020 and prior to 2026.3.1015, the ListBox default item template renders the bound dataTextField value as raw HTML without encoding. An attacker who can modify… |
🎯 How it gets exploited (ATT&CK techniques)
Number of CVEs of this technology mapped to each exploitation or primary-impact technique.