{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/kendo-ui-for-jquery--2026.4.1111/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:progress:kendo_ui_for_jquery:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-124696"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Kendo UI for jQuery (\u003c 2026.4.1111)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Progress"],"content_html":"\u003cp\u003eProgress Kendo UI for jQuery contains a cross-site scripting (XSS) vulnerability in the Spreadsheet component. The vulnerability exists because sheet names are inserted into the data-sheet-name attribute of the SheetsBar menu button without proper encoding. An attacker who can influence a sheet name can inject an event-handler attribute, leading to arbitrary JavaScript execution in the victim browser context upon hovering over the affected UI element.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the execution of arbitrary JavaScript within the user's browser, potentially compromising the confidentiality and integrity of data accessible to the user session.\u003c/p\u003e\n","date_modified":"2026-11-12T18:46:45Z","date_published":"2026-11-12T18:46:45Z","id":"https://feed.craftedsignal.io/briefs/2026-11-kendo-ui-xss-cve-2026-124696/","summary":"Progress Kendo UI for jQuery contains a cross-site scripting vulnerability in the Spreadsheet component allowing for arbitrary JavaScript execution.","title":"Progress Kendo UI for jQuery: Spreadsheet cross-site scripting (CVE-2026-124696)","url":"https://feed.craftedsignal.io/briefs/2026-11-kendo-ui-xss-cve-2026-124696/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:progress:kendo_ui_for_jquery:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-124695"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Kendo UI for jQuery (\u003c 2026.4.1111)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Progress"],"content_html":"\u003cp\u003eProgress Kendo UI for jQuery contains a cross-site scripting (XSS) vulnerability (CVE-2026-124695) originating from the items[].hint configuration option. Although documented to accept only strings, the component renders the hint input as HTML. An attacker capable of influencing a Form item's hint can cause attacker-controlled markup to execute as JavaScript when a user views the rendered form.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the execution of arbitrary JavaScript within the victim's browser session, which may compromise the confidentiality and integrity of data available in the user's browser context.\u003c/p\u003e\n","date_modified":"2026-11-12T18:46:35Z","date_published":"2026-11-12T18:46:35Z","id":"https://feed.craftedsignal.io/briefs/2026-11-progress-kendo-ui-xss-cve-2026-124695/","summary":"Progress Kendo UI for jQuery contains a cross-site scripting vulnerability where the items[].hint configuration option improperly renders user-supplied input as HTML, allowing for the execution of arbitrary JavaScript in a victim's browser.","title":"Progress Kendo UI for jQuery: Cross-Site Scripting (CVE-2026-124695)","url":"https://feed.craftedsignal.io/briefs/2026-11-progress-kendo-ui-xss-cve-2026-124695/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:progress:kendo_ui_for_jquery:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-124691"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Kendo UI for jQuery (\u003c 2026.4.1111)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Progress"],"content_html":"\u003cp\u003eProgress Kendo UI for jQuery Gantt contains a vulnerability where the task editor's Parent dropdown renders task titles as HTML. An attacker capable of influencing a task title displayed in this dropdown can execute arbitrary JavaScript when a user opens or interacts with the task editor.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation may compromise the confidentiality and integrity of data available in the user's browser context.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUsers should update to the version of the software in which this issue has been addressed.\u003c/p\u003e\n","date_modified":"2026-11-12T18:46:24Z","date_published":"2026-11-12T18:46:24Z","id":"https://feed.craftedsignal.io/briefs/2026-11-kendo-ui-xss-cve-2026-124691/","summary":"Progress Kendo UI for jQuery Gantt is vulnerable to a cross-site scripting (XSS) attack via the task editor's Parent dropdown, where unsanitized task titles allow for arbitrary JavaScript execution in the user's browser context.","title":"Progress Kendo UI for jQuery: Cross-Site Scripting in Gantt Task Editor (CVE-2026-124691)","url":"https://feed.craftedsignal.io/briefs/2026-11-kendo-ui-xss-cve-2026-124691/"}],"language":"en","title":"CraftedSignal Threat Feed - Kendo UI for JQuery (\u003c 2026.4.1111)","version":"https://jsonfeed.org/version/1.1"}