TU
Product
Telerik UI for ASP.NET AJAX
On CISA KEVExploited in the wildRansomware-linked
22
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 11Medium 5Low 0
Watch
Add Telerik UI for ASP.NET AJAX to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-18935 RansomwareIn wildKEV | 9.8 | Dec 11 | Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability Affected: All versions, or not specified |
| CVE-2017-11357 RansomwareIn wildKEV | 9.8 | Aug 23 | Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability Affected: before 2020.1.114 |
| CVE-2026-6023 | 9.8 | Apr 22 | Deserialization of Untrusted Data Vulnerability in Telerik UI for ASP.NET AJAX Affected: 2024.4.1114 before 2026.1.421 |
| CVE-2021-28141 | 9.8 | Mar 11 | An issue was discovered in Progress Telerik UI for ASP.NET AJAX 2021.1.224 Affected: 2021.1.224 |
| CVE-2019-19790 | 9.8 | Dec 13 | Path traversal in RadChart in Telerik UI for ASP.NET AJAX allows a remote attacker to read and delete an image with extension .BMP, .EXIF, .GIF, .ICON, .JPEG, .PNG, .TIFF, or .WMF… Affected: All versions, or not specified |
| CVE-2026-13190 | 8.1 | Jul 22 | PersistenceFramework Unsafe Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX Affected: 2011.2712 before 2026.2.708 |
| CVE-2026-13187 | 8.1 | Jul 22 | DialogHandler Provider Type Tampering Vulnerability in Telerik UI for ASP.NET AJAX Affected: 2011.2712 before 2026.2.708 |
| CVE-2026-13186 | 8.1 | Jul 22 | AppDataStorageProvider Path Traversal Deserialization Vulnerability in Telerik UI for ASP.NET AJAX Affected: 2013.1.220 before 2026.2.708 |
| CVE-2026-13185 | 8.1 | Jul 22 | PersistenceFramework Cookie Deserialization Vulnerability in Telerik UI for ASP.NET AJAX Affected: 2013.1.220 before 2026.2.708 |
| CVE-2026-13181 | 8.1 | Jul 22 | RadAsyncUpload AsyncUploadTypeName Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX Affected: 2010.1309 before 2026.2.708 |
| CVE-2026-13189 | 7.5 | Jul 22 | SpellChecker DictionaryLanguage Path Traversal Vulnerability in Telerik UI for ASP.NET AJAX Affected: 2011.2712 before 2026.2.708 |
| CVE-2026-13184 | 7.5 | Jul 22 | RadAsyncUpload Default HMAC Key Fallback Vulnerability in Telerik UI for ASP.NET AJAX Affected: 2010.1309 before 2026.2.708 |
| CVE-2026-13183 | 7.5 | Jul 22 | RadAsyncUpload Upload Metadata Timing Oracle Vulnerability in Telerik UI for ASP.NET AJAX Affected: 2010.1309 before 2026.2.708 |
| CVE-2026-13182 | 7.5 | Jul 22 | RadAsyncUpload Client-State Decrypt-vs-Parse Oracle Vulnerability in Telerik UI for ASP.NET AJAX Affected: 2010.1309 before 2026.2.708 |
| CVE-2026-6022 | 7.5 | Apr 22 | Uncontrolled Resource Consumption Vulnerability in Telerik UI for ASP.NET AJAX Affected: before 2026.1.421 |
| CVE-2025-3600 | 7.5 | May 14 | In Progress® Telerik® UI for AJAX, versions 2011.2.712 to 2025.1.218, an unsafe reflection vulnerability exists that may lead to an unhandled exception resulting in a crash of the… Affected: 2011.2712 through 2025.1.218 |
| CVE-2026-14932 | 6.5 | Jul 22 | Unauthenticated File Read and Deletion via Hardcoded Encryption Key in RadChart Affected: 2009.1311 before 2026.2.708 |
| CVE-2026-13192 | 6.5 | Jul 22 | RadEditor PDF Export SSRF Vulnerability in Telerik UI for ASP.NET AJAX Affected: 2008.31314 before 2026.2.708 |
| CVE-2026-13188 | 5.9 | Jul 22 | DialogHandler Parameters Tampering Vulnerability in Telerik UI for ASP.NET AJAX Affected: 2011.2712 before 2026.2.708 |
| CVE-2026-2878 | 5.9 | Feb 25 | In Progress® Telerik® UI for AJAX, versions prior to 2026.1.225, an insufficient entropy vulnerability exists in RadAsyncUpload, where a predictable temporary identifier, based on… Affected: before 2026.1.225 |
| CVE-2026-14865 | 5.3 | Jul 22 | XXE Denial of Service via RadLayoutBuilder Client State in Telerik UI for ASP.NET AJAX Affected: 2009.31314 before 2026.2.708 |
| CVE-2014-2217 | – | Dec 25 | Absolute path traversal vulnerability in the RadAsyncUpload control in the RadControls in Telerik UI for ASP.NET AJAX before Q3 2012 SP2 allows remote attackers to write to… Affected: through 2014.3.1209 |
Showing 22