Login Request a demo
KU
Product
Kendo UI
by Progress · last CVE Oct 15, 2026
14
CVEs
0
On KEV
7.5
Max CVSS
13
New 30D
Vulnerabilities14In the news0Timeline
Severity mix
Critical 0High 1Medium 13Low 0
Severity
All severities14Critical0High1Medium13Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Kendo UI to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-106163
6.5
0%
Oct 15
Cross-site Scripting (XSS) in Kendo UI for jQuery FileBrowser and ImageBrowser
Affected: 2023.1.117 before 2026.3.1015
CVE-2018-14037
6.1
1%
Sep 28
Cross-site scripting (XSS) vulnerability in Progress Kendo UI Editor v2018.1.221 allows remote attackers to inject arbitrary JavaScript into the DOM of the WYSIWYG editor because…
Affected: 2018.1.221
CVE-2026-106153
5.4
0%
Oct 15
Cross-site Scripting (XSS) in Kendo UI for jQuery Calendar and MultiViewCalendar
Affected: 2011.3.1007 before 2026.3.1015
CVE-2026-106151
5.4
0%
Oct 15
Cross-Site Scripting in Validator Validation Messages in Kendo UI for jQuery
Affected: 2012.2.710 before 2026.3.1015
CVE-2026-106149
5.4
0%
Oct 15
Cross-site Scripting (XSS) in Kendo UI for jQuery Menu
Affected: 2011.2.804 before 2026.3.1015
CVE-2026-106148
5.4
0%
Oct 15
Cross-Site Scripting via TabStrip, Menu, and PanelBar Image URLs in Kendo UI for jQuery
Affected: 2011.2.804 before 2026.3.1015
CVE-2026-106147
5.4
0%
Oct 15
Cross-Site Scripting via ListBox Bound Text in Kendo UI for jQuery
Affected: 2020.1.114 before 2026.3.1015
CVE-2026-106161
5.4
0%
Oct 15
Cross-Site Scripting via Badge Text Binding in Kendo UI for jQuery
Affected: 2020.1.114 before 2026.3.1015
CVE-2026-106160
5.4
0%
Oct 15
Prototype Pollution via Model.accept and kendo.setter in Kendo UI for jQuery
Affected: 2023.1.117 before 2026.3.1015
CVE-2026-106159
4.7
0%
Oct 15
Cross-Site Scripting via ToolBar ButtonGroup URLs in Kendo UI for jQuery
Affected: 2022.3.1109 before 2026.3.1015
CVE-2026-106158
4.7
0%
Oct 15
Cross-Site Scripting via Scheduler Resource Colors in Kendo UI for jQuery
Affected: 2014.3.1119 before 2026.3.1015
CVE-2026-106157
4.7
0%
Oct 15
Cross-Site Scripting via PanelBar Item URLs in Kendo UI for jQuery
Affected: 2019.2.514 before 2026.3.1015
CVE-2026-106162
4.7
0%
Oct 15
Cross-Site Scripting in FileManager Drag Hints in Kendo UI for jQuery
Affected: 2023.3.1010 before 2026.3.1015
Showing 13