Kendo UI for JQuery (<= 2016.2.607) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/kendo-ui-for-jquery--2016.2.607/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 12 Nov 2026 18:47:26 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgProgress Kendo UI for jQuery: Cross-Site Scripting via Chart Tooltiphttps://feed.craftedsignal.io/briefs/2026-11-kendo-ui-xss-cve-2026-124698/Thu, 12 Nov 2026 18:47:26 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-kendo-ui-xss-cve-2026-124698/Progress Kendo UI for jQuery Chart component is vulnerable to an XSS flaw where default tooltips render point values as raw HTML, allowing arbitrary JavaScript execution upon user interaction.Progress Kendo UI for jQuery contains a cross-site scripting (XSS) vulnerability within its Chart component. The default tooltip mechanism renders point values as raw HTML. If an attacker influences a string point value, they can inject markup that executes as JavaScript when a user hovers over the point.

Impact

Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context.

Recommendation

Users should update their software to address the vulnerability.

]]>highadvisory