Kendo UI for JQuery (< 2026.4.1110) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/kendo-ui-for-jquery--2026.4.1110/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 18:01:36 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgProgress Kendo UI for jQuery: PropertyGrid Cross-Site Scripting (CVE-2026-124694)https://feed.craftedsignal.io/briefs/2026-11-kendo-xss-cve-2026-124694/Wed, 11 Nov 2026 18:01:36 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-kendo-xss-cve-2026-124694/Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110 contain an XSS vulnerability in the PropertyGrid component due to insufficient encoding of bound property values.Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110 contain a vulnerability in the PropertyGrid component. The component fails to properly encode bound property values and items[].description in its default configuration.

Impact

An attacker who can influence the affected values can cause JavaScript to execute when a user views the grid, which may compromise the confidentiality and integrity of data available in the user's browser context.

Recommendation

Upgrade to Kendo UI for jQuery version 2026.4.1110 or later.

]]>highadvisoryProgress Kendo UI for jQuery: sanitizeSvgContent() cross-site scripting (CVE-2026-124690)https://feed.craftedsignal.io/briefs/2026-11-kendo-ui-xss-cve-2026-124690/Wed, 11 Nov 2026 18:01:02 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-kendo-ui-xss-cve-2026-124690/Progress Kendo UI for jQuery contains a vulnerability in the sanitizeSvgContent() function where parsing custom icon markup into a live DOM before filtering enables arbitrary JavaScript execution.Progress Kendo UI for jQuery contains a vulnerability in the sanitizeSvgContent() function. The component parses custom icon markup into a live DOM before applying sanitization filters. An attacker who can influence custom icon content can cause JavaScript to execute during icon creation, before an unsafe element is removed.

Impact

Successful exploitation allows for the execution of arbitrary JavaScript.

Recommendation

Upgrade to the fixed version 2026.4.1110.

]]>highadvisory