{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/kendo-ui-for-jquery/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:progress:kendo_ui_for_jquery:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-124692"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Kendo UI for jQuery"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Progress"],"content_html":"\u003cp\u003eProgress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110 are affected by a vulnerability in the Grid and TreeList components. The issue occurs when the column-reorder drag clue reparses header text as HTML. An attacker who can influence a column field or title used by an affected application can cause JavaScript to execute when a user drags a column header while column reordering is enabled.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The vulnerability has a CVSS v3.1 base score of 7.1.\u003c/p\u003e\n","date_modified":"2026-11-11T18:01:16Z","date_published":"2026-11-11T18:01:16Z","id":"https://feed.craftedsignal.io/briefs/2026-11-kendo-ui-xss-cve-2026-124692/","summary":"Progress Kendo UI for jQuery contains a vulnerability in the Grid and TreeList components where column-reorder drag clues parse header text as HTML, potentially allowing JavaScript execution.","title":"Progress Kendo UI for jQuery Vulnerability (CVE-2026-124692)","url":"https://feed.craftedsignal.io/briefs/2026-11-kendo-ui-xss-cve-2026-124692/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-124689"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Kendo UI for jQuery"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Progress"],"content_html":"\u003cp\u003eProgress Kendo UI for jQuery versions 2026.3.1014 up to, but not including, 2026.4.1110 contain a vulnerability in the ActionSheet component. The component does not encode title, subtitle, and header button label values before rendering them. An attacker who can influence these values can inject markup that executes as JavaScript when a user opens the ActionSheet.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation may compromise the confidentiality and integrity of data available in the user's browser context.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eThe vulnerability is addressed in version 2026.4.1110.\u003c/p\u003e\n","date_modified":"2026-11-11T18:00:52Z","date_published":"2026-11-11T18:00:52Z","id":"https://feed.craftedsignal.io/briefs/2026-11-kendo-ui-xss-cve-2026-124689/","summary":"Progress Kendo UI for jQuery versions 2026.3.1014 up to, but not including, 2026.4.1110 contain a vulnerability in the ActionSheet component where input fields are not encoded before rendering.","title":"Progress Kendo UI for jQuery Vulnerability (CVE-2026-124689)","url":"https://feed.craftedsignal.io/briefs/2026-11-kendo-ui-xss-cve-2026-124689/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-124688"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Kendo UI for jQuery"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Progress"],"content_html":"\u003cp\u003eProgress Kendo UI for jQuery versions prior to 2026.4.1111 contain a vulnerability in the TabStrip, PanelBar, and Menu widgets. The issue exists because these widgets support mapping a dataSource field to the \u003ccode\u003espriteCssClass\u003c/code\u003e attribute. If an attacker controls the mapped data, they can break out of the attribute and inject markup, including event-handler attributes.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe injected JavaScript executes in the application's origin when a victim loads a page rendering the affected widget, allowing access to data and actions available in the victim's authenticated session.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpgrade to Progress Kendo UI for jQuery version 2026.4.1111 or later.\u003c/p\u003e\n","date_modified":"2026-11-11T18:00:43Z","date_published":"2026-11-11T18:00:43Z","id":"https://feed.craftedsignal.io/briefs/2026-11-kendo-ui-xss-cve-2026-124688/","summary":"Progress Kendo UI for jQuery versions prior to 2026.4.1111 are vulnerable to markup injection in the TabStrip, PanelBar, and Menu widgets when a dataSource field is mapped to spriteCssClass, potentially leading to unauthorized JavaScript execution.","title":"Progress Kendo UI for jQuery: Markup injection in TabStrip, PanelBar, and Menu widgets (CVE-2026-124688)","url":"https://feed.craftedsignal.io/briefs/2026-11-kendo-ui-xss-cve-2026-124688/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-124687"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Kendo UI for jQuery"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Progress"],"content_html":"\u003cp\u003eProgress Kendo UI for jQuery contains a markup injection vulnerability in the DropDownButton and SplitButton components, identified as CVE-2026-124687. The vulnerability affects versions from 2022.2.621 prior to 2026.4.1111. An attacker who can influence the 'id' and 'target' attributes of these components can break out of the attributes and inject markup, including event handlers. The issue is fixed in 2026.4.1111.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAn attacker who can influence these item values can break out of the attributes and inject markup, including event handlers. This vulnerability has a CVSS v3.1 base score of 7.1.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpgrade Progress Kendo UI for jQuery to version 2026.4.1111.\u003c/p\u003e\n","date_modified":"2026-11-11T18:00:33Z","date_published":"2026-11-11T18:00:33Z","id":"https://feed.craftedsignal.io/briefs/2026-11-kendo-ui-injection-cve-2026-124687/","summary":"Progress Kendo UI for jQuery versions from 2022.2.621 prior to 2026.4.1111 contain a markup injection vulnerability in the DropDownButton and SplitButton components via the id and target attributes.","title":"Progress Kendo UI for jQuery: Markup injection in DropDownButton and SplitButton (CVE-2026-124687)","url":"https://feed.craftedsignal.io/briefs/2026-11-kendo-ui-injection-cve-2026-124687/"}],"language":"en","title":"CraftedSignal Threat Feed - Kendo UI for JQuery","version":"https://jsonfeed.org/version/1.1"}