{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aprogresskendo_ui_for_jquery/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:progress:kendo_ui_for_jquery:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-124694"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Kendo UI for jQuery (\u003c 2026.4.1110)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Progress"],"content_html":"\u003cp\u003eProgress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110 contain a vulnerability in the PropertyGrid component. The component fails to properly encode bound property values and items[].description in its default configuration.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAn attacker who can influence the affected values can cause JavaScript to execute when a user views the grid, which may compromise the confidentiality and integrity of data available in the user's browser context.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpgrade to Kendo UI for jQuery version 2026.4.1110 or later.\u003c/p\u003e\n","date_modified":"2026-11-11T18:01:36Z","date_published":"2026-11-11T18:01:36Z","id":"https://feed.craftedsignal.io/briefs/2026-11-kendo-xss-cve-2026-124694/","summary":"Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110 contain an XSS vulnerability in the PropertyGrid component due to insufficient encoding of bound property values.","title":"Progress Kendo UI for jQuery: PropertyGrid Cross-Site Scripting (CVE-2026-124694)","url":"https://feed.craftedsignal.io/briefs/2026-11-kendo-xss-cve-2026-124694/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:progress:kendo_ui_for_jquery:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-124692"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Kendo UI for jQuery"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Progress"],"content_html":"\u003cp\u003eProgress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110 are affected by a vulnerability in the Grid and TreeList components. The issue occurs when the column-reorder drag clue reparses header text as HTML. An attacker who can influence a column field or title used by an affected application can cause JavaScript to execute when a user drags a column header while column reordering is enabled.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The vulnerability has a CVSS v3.1 base score of 7.1.\u003c/p\u003e\n","date_modified":"2026-11-11T18:01:16Z","date_published":"2026-11-11T18:01:16Z","id":"https://feed.craftedsignal.io/briefs/2026-11-kendo-ui-xss-cve-2026-124692/","summary":"Progress Kendo UI for jQuery contains a vulnerability in the Grid and TreeList components where column-reorder drag clues parse header text as HTML, potentially allowing JavaScript execution.","title":"Progress Kendo UI for jQuery Vulnerability (CVE-2026-124692)","url":"https://feed.craftedsignal.io/briefs/2026-11-kendo-ui-xss-cve-2026-124692/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:progress:kendo_ui_for_jquery:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-124690"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Kendo UI for jQuery (\u003c 2026.4.1110)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Progress"],"content_html":"\u003cp\u003eProgress Kendo UI for jQuery contains a vulnerability in the sanitizeSvgContent() function. The component parses custom icon markup into a live DOM before applying sanitization filters. An attacker who can influence custom icon content can cause JavaScript to execute during icon creation, before an unsafe element is removed.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the execution of arbitrary JavaScript.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpgrade to the fixed version 2026.4.1110.\u003c/p\u003e\n","date_modified":"2026-11-11T18:01:02Z","date_published":"2026-11-11T18:01:02Z","id":"https://feed.craftedsignal.io/briefs/2026-11-kendo-ui-xss-cve-2026-124690/","summary":"Progress Kendo UI for jQuery contains a vulnerability in the sanitizeSvgContent() function where parsing custom icon markup into a live DOM before filtering enables arbitrary JavaScript execution.","title":"Progress Kendo UI for jQuery: sanitizeSvgContent() cross-site scripting (CVE-2026-124690)","url":"https://feed.craftedsignal.io/briefs/2026-11-kendo-ui-xss-cve-2026-124690/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:progress:kendo_ui_for_jquery:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}