Kendo UI for JQuery (< 2026.4.1111)

Progress Kendo UI for jQuery contains a cross-site scripting vulnerability in the Spreadsheet component allowing for arbitrary JavaScript execution.

Progress Kendo UI for jQuery contains a cross-site scripting vulnerability where the items[].hint configuration option improperly renders user-supplied input as HTML, allowing for the execution of arbitrary JavaScript in a victim's browser.

Progress Kendo UI for jQuery Gantt is vulnerable to a cross-site scripting (XSS) attack via the task editor's Parent dropdown, where unsanitized task titles allow for arbitrary JavaScript execution in the user's browser context.