Threats affecting pkg:nuget/telerik.ui.for.winforms

A deserialization of untrusted data vulnerability (CWE-502) exists in Progress Software's Telerik UI for WinForms versions from 2026.3.1007 up to but not including 2026.4.1111. This flaw allows an attacker to perform unauthorized actions within the context of the affected application. The vulnerability has a high severity with a CVSS score of 7.8. A fix is available in version 2026.4.1111.

CVE-2026-124699 is a code injection vulnerability in Progress Software's Telerik UI for WinForms affecting versions from 2026.3.1007 up to but not including 2026.4.1111. The flaw allows an attacker to supply a crafted expression that leads to unauthorized code execution within the affected application context. This vulnerability has a high severity rating with a CVSS score of 7.8. The issue is fixed in version 2026.4.1111.