Threat database

CVE-2026-106150 is a cross-site scripting (XSS) vulnerability in Progress Software Kendo UI for jQuery affecting the Splitter, Window, and Tooltip components. Versions from 2011.2.804 and 2013.1.319 up to but not including 2026.3.1015 are vulnerable. The issue arises because these components improperly sanitize URL values and do not encode iframe titles correctly, allowing attackers with low privileges to inject malicious JavaScript. Exploitation requires user interaction and can compromise confidentiality and integrity of data accessible in the user's browser.

CVE-2026-106149 is a medium severity vulnerability in Progress Software Kendo UI for jQuery prior to version 2026.3.1015. The Menu component improperly neutralizes script-related HTML tags by constructing HTML attributes from bound dataSource fields via string concatenation without proper sanitization. This allows an attacker with low privileges who can control these fields to inject JavaScript event-handler attributes. The injected code executes when a user interacts with the affected Menu, potentially compromising confidentiality and integrity of data in the user's browser context.

CVE-2026-106148 is a cross-site scripting (XSS) vulnerability in Progress Software Kendo UI for jQuery affecting the TabStrip, Menu, and PanelBar components. These components improperly insert imageUrl values into single-quoted image src attributes without proper escaping, allowing attackers who can modify image URLs to inject HTML attributes and execute JavaScript in users' browsers. This vulnerability affects versions from 2011.2.804 up to but not including 2026.3.1015. The issue is fixed in version 2026.3.1015.

CVE-2026-106147 is a cross-site scripting (XSS) vulnerability in Progress Software Kendo UI for jQuery. The issue exists in versions from 2020.1.114 up to but not including 2026.3.1015, where the ListBox default item template renders bound data as raw HTML without encoding. This allows an attacker who can control the bound data to inject HTML with event handlers that execute JavaScript in users' browsers. The vulnerability can lead to compromise of confidentiality and integrity of data accessible to the application. The issue is fixed in version 2026.3.1015.

CVE-2026-106161 is a cross-site scripting (XSS) vulnerability in Progress Software Kendo UI for jQuery. The Badge text method improperly renders string values as raw HTML without encoding, allowing injection of malicious scripts via data bound to a Badge. This vulnerability affects versions from 2020.1.114 up to but not including 2026.3.1015. The issue is fixed in version 2026.3.1015.

CVE-2026-106160 is a prototype pollution vulnerability in Progress Software Kendo UI for jQuery versions from 2023.1.117 up to but not including 2026.3.1015. The issue arises because the Model.accept function passes server-response keys to kendo.setter without properly filtering unsafe object paths such as __proto__, constructor, or prototype. This allows an attacker who can supply crafted data to modify object prototype attributes, potentially affecting application behavior and compromising confidentiality and integrity of data. The vulnerability is fixed in version 2026.3.1015.

CVE-2026-106159 is a cross-site scripting (XSS) vulnerability in Progress Software Kendo UI for jQuery. It affects versions from 2022.3.1109 up to but not including 2026.3.1015. The issue arises because ToolBar ButtonGroup button URLs are concatenated into an unquoted href attribute after URL sanitization, allowing an attacker to inject JavaScript via specially crafted URLs. This can lead to execution of malicious scripts in the user's browser when interacting with the affected buttons. The vulnerability is fixed in version 2026.3.1015.

CVE-2026-106158 is a cross-site scripting (XSS) vulnerability in Progress Software Kendo UI for jQuery versions from 2014.3.1119 up to but not including 2026.3.1015. The issue occurs because resource color values are inserted into event wrapper attributes without proper encoding, allowing attackers who control these colors to inject malicious HTML attributes and JavaScript. This can lead to compromise of data confidentiality and integrity when users interact with affected events. The vulnerability has a medium severity with a CVSS score of 4.7 and is fixed in version 2026.3.1015.

A cross-site scripting (XSS) vulnerability exists in Progress Software Kendo UI for jQuery's PanelBar component. Versions from 2019.2.514 up to but not including 2026.3.1015 improperly insert URL values into a single-quoted href attribute without proper encoding. This allows an attacker controlling the URL to inject HTML attributes and JavaScript, potentially compromising data confidentiality and integrity. The issue is fixed in version 2026.3.1015.

CVE-2026-106162 is a cross-site scripting (XSS) vulnerability in Progress Software Kendo UI for jQuery's FileManager component. Versions from 2023.3.1010 up to but not including 2026.3.1015 improperly render remotely supplied item names as HTML in drag hints, allowing injection of malicious scripts. This can lead to execution of JavaScript in a user's browser during drag operations, potentially compromising data confidentiality and integrity. The issue is fixed in version 2026.3.1015.

CVE-2026-106163 is a cross-site scripting (XSS) vulnerability in Progress Software Kendo UI for jQuery affecting the FileBrowser and ImageBrowser components. Versions from 2023.1.117 up to but not including 2026.3.1015 improperly render attacker-controlled file and directory names as HTML without proper encoding. This allows execution of arbitrary JavaScript in the user's browser, potentially compromising confidentiality and integrity of accessible data. The vulnerability has a CVSS 3.1 score of 6.5 (medium severity). No official patch or remediation details are provided in the input data.

CVE-2026-89077 is a high-severity vulnerability in Progress MOVEit Transfer's SFTP module caused by an incorrect implementation of the authentication algorithm. It affects versions before 2025.1.6 and versions from 2026.0.0 up to but not including 2026.0.4. The flaw can lead to a complete compromise of confidentiality, integrity, and availability of the affected system. No known exploits are reported in the wild. The vulnerability has a CVSS score of 7.5, indicating a significant risk if exploited.

CVE-2026-89076 is a high-severity SQL injection vulnerability in the Custom Reports module of Progress MOVEit Transfer. It affects versions before 2025.1.6 and from 2026.0.0 up to but not including 2026.0.4. The vulnerability allows improper neutralization of special elements in SQL commands, potentially leading to full confidentiality, integrity, and availability compromise. No known exploits are reported in the wild. The CVSS score is 7.2, indicating a significant risk if exploited.

CVE-2026-89075 is a high-severity vulnerability in Progress MOVEit Transfer involving insecure storage of sensitive information. It affects versions before 2025.1.6 and versions from 2026.0.0 up to but not including 2026.0.4. The vulnerability has a CVSS score of 7.3, indicating significant confidentiality, integrity, and availability impacts. No vendor advisory or patch information is provided in the input data.

CVE-2026-89074 is a high-severity vulnerability in Progress MOVEit Transfer involving improper handling of Unicode encoding. It affects versions before 2025.1.6 and versions from 2026.0.0 up to but not including 2026.0.4. The vulnerability can lead to high impact on confidentiality, integrity, and availability. No specific patch links are provided in the data, and no known exploits are reported in the wild.

CVE-2026-89073 is a high-severity vulnerability in Progress MOVEit Transfer involving insufficient session expiration. It affects versions before 2025.1.6 and versions from 2026.0.0 up to but not including 2026.0.4. The vulnerability could allow an attacker to maintain access through sessions that do not expire properly, potentially leading to full compromise of confidentiality, integrity, and availability. No known exploits are reported in the wild. The CVSS score is 7.5, indicating a significant risk that requires attention.

CVE-2026-89072 is an Incorrect Authorization vulnerability in the Client Certificates module of Progress MOVEit Transfer. It affects versions before 2025.1.6 and versions from 2026.0.0 up to but not including 2026.0.4. The vulnerability has a high severity with a CVSS score of 7.5, indicating it can lead to high impact on confidentiality, integrity, and availability. No known exploits are reported in the wild. The vendor has not provided explicit patch links or advisories in the provided data.

CVE-2026-89071 is a high-severity LDAP injection vulnerability in the LDAP module of Progress MOVEit Transfer. It affects versions before 2025.1.6 and from 2026.0.0 up to but not including 2026.0.4. The vulnerability involves improper neutralization of special elements in LDAP queries, which can lead to unauthorized access or modification of data. The CVSS score is 7.5, indicating a significant impact on confidentiality, integrity, and availability. No known exploits are reported in the wild. The vendor has not provided explicit patch links in the input data, so patch status should be verified with the vendor advisory.

CVE-2026-89070 is an authentication bypass vulnerability in the OpenID Connect (OIDC) module of Progress MOVEit Transfer. It allows an attacker to bypass authentication by replaying captured authentication data. The vulnerability affects MOVEit Transfer versions before 2025.1.6 and versions from 2026.0.0 up to but not including 2026.0.4. The issue has a high severity rating with a CVSS score of 7.5. No known exploits in the wild have been reported. No explicit patch links are provided in the data.

CVE-2026-89069 is a high-severity cross-site scripting (XSS) vulnerability in the Ad Hoc module of Progress MOVEit Transfer. It involves improper neutralization of input during web page generation, which could allow an attacker with limited privileges to execute arbitrary code in the context of a user's browser. The vulnerability affects MOVEit Transfer versions before 2025.1.6 and versions from 2026.0.0 up to but not including 2026.0.4.