Threat database

CVE-2026-108116 is a high-severity vulnerability in Progress Software Kendo UI for jQuery versions from 2014.2.716 up to but not including 2026.3.1015. It involves improper neutralization of special elements in output used by a downstream component, specifically in the PivotGrid XMLA transport. This flaw allows specially crafted filter values to alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection.

CVE-2026-106153 is a cross-site scripting (XSS) vulnerability in Progress Software Kendo UI for jQuery versions from 2011.3.1007 up to but not including 2026.3.1015. The issue arises because the Calendar and MultiViewCalendar month content templates render data.url and data.title without proper sanitization or HTML attribute encoding. An attacker with low privileges who can control these values can inject malicious JavaScript that executes in the context of users interacting with the affected calendar components, potentially compromising confidentiality and integrity of accessible data.

A cross-site scripting (XSS) vulnerability exists in Progress Software Kendo UI for jQuery versions from 2012.2.710 up to but not including 2026.3.1015. The Validator component improperly decodes and parses validation messages from data-msg-* attributes as HTML, allowing an attacker who can modify these messages to execute arbitrary JavaScript in the user's browser. This can compromise confidentiality and integrity of data accessible to the affected application. The issue is fixed in version 2026.3.1015.

CVE-2026-106150 is a cross-site scripting (XSS) vulnerability in Progress Software Kendo UI for jQuery affecting the Splitter, Window, and Tooltip components. Versions from 2011.2.804 and 2013.1.319 up to but not including 2026.3.1015 are vulnerable. The issue arises because these components improperly sanitize URL values and do not encode iframe titles correctly, allowing attackers with low privileges to inject malicious JavaScript. Exploitation requires user interaction and can compromise confidentiality and integrity of data accessible in the user's browser.

CVE-2026-106149 is a medium severity vulnerability in Progress Software Kendo UI for jQuery prior to version 2026.3.1015. The Menu component improperly neutralizes script-related HTML tags by constructing HTML attributes from bound dataSource fields via string concatenation without proper sanitization. This allows an attacker with low privileges who can control these fields to inject JavaScript event-handler attributes. The injected code executes when a user interacts with the affected Menu, potentially compromising confidentiality and integrity of data in the user's browser context.

CVE-2026-106148 is a cross-site scripting (XSS) vulnerability in Progress Software Kendo UI for jQuery affecting the TabStrip, Menu, and PanelBar components. These components improperly insert imageUrl values into single-quoted image src attributes without proper escaping, allowing attackers who can modify image URLs to inject HTML attributes and execute JavaScript in users' browsers. This vulnerability affects versions from 2011.2.804 up to but not including 2026.3.1015. The issue is fixed in version 2026.3.1015.

CVE-2026-106147 is a cross-site scripting (XSS) vulnerability in Progress Software Kendo UI for jQuery. The issue exists in versions from 2020.1.114 up to but not including 2026.3.1015, where the ListBox default item template renders bound data as raw HTML without encoding. This allows an attacker who can control the bound data to inject HTML with event handlers that execute JavaScript in users' browsers. The vulnerability can lead to compromise of confidentiality and integrity of data accessible to the application. The issue is fixed in version 2026.3.1015.

CVE-2026-106161 is a cross-site scripting (XSS) vulnerability in Progress Software Kendo UI for jQuery. The Badge text method improperly renders string values as raw HTML without encoding, allowing injection of malicious scripts via data bound to a Badge. This vulnerability affects versions from 2020.1.114 up to but not including 2026.3.1015. The issue is fixed in version 2026.3.1015.

CVE-2026-106160 is a prototype pollution vulnerability in Progress Software Kendo UI for jQuery versions from 2023.1.117 up to but not including 2026.3.1015. The issue arises because the Model.accept function passes server-response keys to kendo.setter without properly filtering unsafe object paths such as __proto__, constructor, or prototype. This allows an attacker who can supply crafted data to modify object prototype attributes, potentially affecting application behavior and compromising confidentiality and integrity of data. The vulnerability is fixed in version 2026.3.1015.

CVE-2026-106159 is a cross-site scripting (XSS) vulnerability in Progress Software Kendo UI for jQuery. It affects versions from 2022.3.1109 up to but not including 2026.3.1015. The issue arises because ToolBar ButtonGroup button URLs are concatenated into an unquoted href attribute after URL sanitization, allowing an attacker to inject JavaScript via specially crafted URLs. This can lead to execution of malicious scripts in the user's browser when interacting with the affected buttons. The vulnerability is fixed in version 2026.3.1015.

CVE-2026-106158 is a cross-site scripting (XSS) vulnerability in Progress Software Kendo UI for jQuery versions from 2014.3.1119 up to but not including 2026.3.1015. The issue occurs because resource color values are inserted into event wrapper attributes without proper encoding, allowing attackers who control these colors to inject malicious HTML attributes and JavaScript. This can lead to compromise of data confidentiality and integrity when users interact with affected events. The vulnerability has a medium severity with a CVSS score of 4.7 and is fixed in version 2026.3.1015.

A cross-site scripting (XSS) vulnerability exists in Progress Software Kendo UI for jQuery's PanelBar component. Versions from 2019.2.514 up to but not including 2026.3.1015 improperly insert URL values into a single-quoted href attribute without proper encoding. This allows an attacker controlling the URL to inject HTML attributes and JavaScript, potentially compromising data confidentiality and integrity. The issue is fixed in version 2026.3.1015.

CVE-2026-106162 is a cross-site scripting (XSS) vulnerability in Progress Software Kendo UI for jQuery's FileManager component. Versions from 2023.3.1010 up to but not including 2026.3.1015 improperly render remotely supplied item names as HTML in drag hints, allowing injection of malicious scripts. This can lead to execution of JavaScript in a user's browser during drag operations, potentially compromising data confidentiality and integrity. The issue is fixed in version 2026.3.1015.

CVE-2026-106163 is a cross-site scripting (XSS) vulnerability in Progress Software Kendo UI for jQuery affecting the FileBrowser and ImageBrowser components. Versions from 2023.1.117 up to but not including 2026.3.1015 improperly render attacker-controlled file and directory names as HTML without proper encoding. This allows execution of arbitrary JavaScript in the user's browser, potentially compromising confidentiality and integrity of accessible data. The vulnerability has a CVSS 3.1 score of 6.5 (medium severity). No official patch or remediation details are provided in the input data.

CVE-2026-85976 is a medium severity vulnerability in Progress Software Corporation's MarkLogic Server. Versions 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0, do not properly sanitize input to the Query Console file-exploration endpoint. This improper neutralization of CRLF sequences in HTTP headers can lead to HTTP response splitting, potentially causing unintended client-side response handling.

Progress MarkLogic Server versions 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0, may transmit sensitive information in cleartext when connecting to Amazon S3 by default. This vulnerability allows a network attacker to intercept data or credentials sent over these connections. The issue is identified as CWE-319 (Cleartext Transmission of Sensitive Information). A fix is available to address this vulnerability.

Progress MarkLogic Server versions 11.x prior to 11.3.7 and 12.x prior to 12.1.0 have a vulnerability where TLS certificate hostnames are not consistently validated for certain outbound connections. This improper validation could allow a network-positioned attacker to intercept or modify communications with the affected service. The vulnerability is identified as CWE-297 and has a CVSS 3.1 score of 7.4, indicating high severity.

Progress Software Corporation MarkLogic Server versions 12.0.0 up to but not including 12.1.0 have a vulnerability involving cleartext transmission of sensitive information in certain cluster-management communications. This allows a network-positioned attacker to intercept or modify data transmitted over affected connections. The vulnerability is identified as CWE-319 and has a CVSS 3.1 score of 7.4, indicating high severity.

Progress MarkLogic Server versions 11.0.0 through before 11.3.7 and 12.0.0 through before 12.1.0 contain an authentication vulnerability. The Kerberos authentication service identity is not sufficiently verified in certain password-based authentication configurations. This flaw could allow a network attacker to impersonate trusted authentication infrastructure, potentially leading to unauthorized access or modification of protected data.