Kendo UI for JQuery (< 2026.4.1111) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/kendo-ui-for-jquery--2026.4.1111/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 12 Nov 2026 18:46:45 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgProgress Kendo UI for jQuery: Spreadsheet cross-site scripting (CVE-2026-124696)https://feed.craftedsignal.io/briefs/2026-11-kendo-ui-xss-cve-2026-124696/Thu, 12 Nov 2026 18:46:45 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-kendo-ui-xss-cve-2026-124696/Progress Kendo UI for jQuery contains a cross-site scripting vulnerability in the Spreadsheet component allowing for arbitrary JavaScript execution.Progress Kendo UI for jQuery contains a cross-site scripting (XSS) vulnerability in the Spreadsheet component. The vulnerability exists because sheet names are inserted into the data-sheet-name attribute of the SheetsBar menu button without proper encoding. An attacker who can influence a sheet name can inject an event-handler attribute, leading to arbitrary JavaScript execution in the victim browser context upon hovering over the affected UI element.

Impact

Successful exploitation allows for the execution of arbitrary JavaScript within the user's browser, potentially compromising the confidentiality and integrity of data accessible to the user session.

]]>highadvisoryProgress Kendo UI for jQuery: Cross-Site Scripting (CVE-2026-124695)https://feed.craftedsignal.io/briefs/2026-11-progress-kendo-ui-xss-cve-2026-124695/Thu, 12 Nov 2026 18:46:35 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-progress-kendo-ui-xss-cve-2026-124695/Progress Kendo UI for jQuery contains a cross-site scripting vulnerability where the items[].hint configuration option improperly renders user-supplied input as HTML, allowing for the execution of arbitrary JavaScript in a victim's browser.Progress Kendo UI for jQuery contains a cross-site scripting (XSS) vulnerability (CVE-2026-124695) originating from the items[].hint configuration option. Although documented to accept only strings, the component renders the hint input as HTML. An attacker capable of influencing a Form item's hint can cause attacker-controlled markup to execute as JavaScript when a user views the rendered form.

Impact

Successful exploitation allows for the execution of arbitrary JavaScript within the victim's browser session, which may compromise the confidentiality and integrity of data available in the user's browser context.

]]>highadvisoryProgress Kendo UI for jQuery: Cross-Site Scripting in Gantt Task Editor (CVE-2026-124691)https://feed.craftedsignal.io/briefs/2026-11-kendo-ui-xss-cve-2026-124691/Thu, 12 Nov 2026 18:46:24 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-kendo-ui-xss-cve-2026-124691/Progress Kendo UI for jQuery Gantt is vulnerable to a cross-site scripting (XSS) attack via the task editor's Parent dropdown, where unsanitized task titles allow for arbitrary JavaScript execution in the user's browser context.Progress Kendo UI for jQuery Gantt contains a vulnerability where the task editor's Parent dropdown renders task titles as HTML. An attacker capable of influencing a task title displayed in this dropdown can execute arbitrary JavaScript when a user opens or interacts with the task editor.

Impact

Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context.

Recommendation

Users should update to the version of the software in which this issue has been addressed.

]]>highadvisory