Progress Software Kendo UI For jQuery vulnerabilities

15 CVEs affecting Progress Software Kendo UI For jQuery, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-108116, published 2026-10-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-6725, published 2025-07-02. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. In the PdfViewer component, a Cross-Site Scripting (XSS) vulnerability is possible if a specially-crafted document has already been loaded and the user engages with a tool that requires the DOM to be…
CVE-2026-108116, published 2026-10-15. High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days. In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially…
CVE-2026-106160, published 2026-10-15. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. In Progress® Kendo® UI for jQuery prior to 2026.3.1015, Model.accept passes server-response keys to kendo.setter without guarding against unsafe object paths containing __proto__, constructor, or…
CVE-2026-106163, published 2026-10-15. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components render remotely supplied file and directory names as HTML…
CVE-2026-106153, published 2026-10-15. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. In Progress® Kendo® UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar month content templates render data.url and data.title without proper URL sanitization and HTML…
CVE-2026-106151, published 2026-10-15. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. In Progress® Kendo® UI for jQuery versions starting with 2012.2.710 and prior to 2026.3.1015, the Validator decodes validation messages from data-msg-* attributes and parses the resulting text as…
CVE-2026-106150, published 2026-10-15. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the Splitter and Window components starting with version 2011.2.804 and the Tooltip component starting with version 2013.1.319 construct iframe…
CVE-2026-106149, published 2026-10-15. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string concatenation without proper neutralization. An attacker…
CVE-2026-106161, published 2026-10-15. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. In Progress® Kendo® UI for jQuery releases starting with v2020.1.114 and prior to 2026.3.1015, the Badge text method renders string values as raw HTML without encoding, including values supplied…
CVE-2026-106148, published 2026-10-15. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the TabStrip, Menu, and PanelBar components insert data source imageUrl values into single-quoted image src attributes without proper escaping.…

Latest

CVE-2026-106162, published 2026-10-15. Medium severity, CVSS 4.7. EPSS: 0.1% chance of exploitation in the next 30 days. In Progress® Kendo® UI for jQuery versions starting with 2023.3.1010 and prior to 2026.3.1015, the FileManager component renders remotely supplied item names as HTML in its default drag hint even…
CVE-2026-106159, published 2026-10-15. Medium severity, CVSS 4.7. EPSS: 0.2% chance of exploitation in the next 30 days. In Progress® Kendo® UI for jQuery versions starting with 2022.3.1109 and prior to 2026.3.1015, ToolBar ButtonGroup button URLs are concatenated into an unquoted href attribute after URL sanitization.…