# Progress Kendo UI for jQuery vulnerabilities Source: https://junglewise.ai/threats/technologies/kendo-ui-for-jquery Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 18:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/kendo-ui-for-jquery.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 25 vulnerabilities in Progress Kendo UI for jQuery: 12 in the last 7 days and 25 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-124698, was published on 12 November 2026. 13 vulnerabilities in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 12 - Last 30 days: 25 - Last 90 days: 25 - All time: 25 (0 critical, 0 exploited in the wild) ## About Progress Kendo UI for jQuery Kendo UI for jQuery is a JavaScript framework providing UI components and widgets. ## Latest Progress Kendo UI for jQuery vulnerabilities - [CVE-2026-124698: Progress Telerik Kendo UI for jQuery Chart XSS in tooltip](https://junglewise.ai/threats/cve-2026-124698-in-progress-kendo-ui-for-jquery-the-chart-default-tooltip) (high, CVSS 7.1, published 12 Nov 2026) - [CVE-2026-124697: Progress Telerik Kendo UI for jQuery Chart XSS in shared-tooltip](https://junglewise.ai/threats/cve-2026-124697-in-progress-kendo-ui-for-jquery-chart-shared-tooltip-rendering) (high, CVSS 7.1, published 12 Nov 2026) - [CVE-2026-124696: Progress Kendo UI for jQuery Spreadsheet XSS in sheet names](https://junglewise.ai/threats/cve-2026-124696-in-progress-kendo-ui-for-jquery-spreadsheet-sheet-names-are) (high, CVSS 7.1, published 12 Nov 2026) - [CVE-2026-124695: Progress Telerik Kendo UI jQuery Form cross-site scripting in item hints](https://junglewise.ai/threats/cve-2026-124695-in-progress-kendo-ui-for-jquery-form-the-items-hint-option-is) (high, CVSS 7.1, published 12 Nov 2026) - [CVE-2026-124691: Progress Telerik Kendo UI for jQuery Gantt cross-site scripting in Parent dropdown](https://junglewise.ai/threats/cve-2026-124691-in-progress-kendo-ui-for-jquery-gantt-the-task-editor-s-parent) (high, CVSS 7.1, published 12 Nov 2026) - [CVE-2026-124694: Progress Kendo UI for jQuery PropertyGrid XSS in bound values](https://junglewise.ai/threats/cve-2026-124694-in-progress-kendo-ui-for-jquery-versions-2026-3-1015-up-to-but) (high, CVSS 7.1, published 11 Nov 2026) - [CVE-2026-124692: Progress Kendo UI for jQuery XSS in Grid column-reorder drag clue](https://junglewise.ai/threats/cve-2026-124692-in-progress-kendo-ui-for-jquery-versions-2026-3-1015-up-to-but) (high, CVSS 7.1, published 11 Nov 2026) - [CVE-2026-124690: Progress Kendo UI for jQuery DOM-based XSS in SVG icon sanitization](https://junglewise.ai/threats/cve-2026-124690-in-progress-kendo-ui-for-jquery-sanitizesvgcontent-parses-custom) (high, CVSS 7.1, published 11 Nov 2026) - [CVE-2026-124689: Progress Kendo UI for jQuery ActionSheet XSS in header encoding](https://junglewise.ai/threats/cve-2026-124689-in-progress-kendo-ui-for-jquery-versions-2026-3-1014-up-to-but) (high, CVSS 7.1, published 11 Nov 2026) - [CVE-2026-124688: Progress Kendo UI for jQuery XSS in TabStrip, PanelBar, Menu widgets](https://junglewise.ai/threats/cve-2026-124688-in-progress-kendo-ui-for-jquery-prior-to-2026-4-1111-the) (high, CVSS 7.1, published 11 Nov 2026) - [CVE-2026-124687: Progress Kendo UI for jQuery markup injection in DropDownButton and SplitButton](https://junglewise.ai/threats/cve-2026-124687-in-progress-kendo-ui-for-jquery-versions-from-2022-2-621-prior) (high, CVSS 7.1, published 11 Nov 2026) - [CVE-2026-124686: Progress Kendo UI for jQuery code injection in kendo.init()](https://junglewise.ai/threats/cve-2026-124686-in-progress-kendo-ui-for-jquery-versions-prior-to-2026-4-1111) (medium, CVSS 5.4, published 11 Nov 2026) - [CVE-2026-108116: Progress Kendo UI for jQuery MDX and SOAP injection in PivotGrid](https://junglewise.ai/threats/cve-2026-108116-in-progress-kendo-ui-for-jquery-prior-to-v2026-3-1015-specially) (high, CVSS 7.5, published 15 Oct 2026) - [CVE-2026-106153: Progress Kendo UI for jQuery cross-site scripting in Calendar](https://junglewise.ai/threats/cve-2026-106153-in-progress-kendo-ui-for-jquery-prior-to-version-2026-3-1015-the) (medium, CVSS 5.4, published 15 Oct 2026) - [CVE-2026-106151: Progress Kendo UI for jQuery Validator cross-site scripting](https://junglewise.ai/threats/cve-2026-106151-in-progress-kendo-ui-for-jquery-versions-starting-with-2012-2) (medium, CVSS 5.4, published 15 Oct 2026) - [CVE-2026-106149: Progress Kendo UI for jQuery Menu component stored XSS](https://junglewise.ai/threats/cve-2026-106149-in-progress-kendo-ui-for-jquery-prior-to-v2026-3-1015-the-menu) (medium, CVSS 5.4, published 15 Oct 2026) - [CVE-2026-106163: Progress Kendo UI for jQuery cross-site scripting in FileBrowser and ImageBrowser](https://junglewise.ai/threats/cve-2026-106163-in-progress-kendo-ui-for-jquery-versions-starting-with-v2023-1) (medium, CVSS 6.5, published 15 Oct 2026) - [CVE-2026-106162: Progress Kendo UI for jQuery FileManager XSS in drag hints](https://junglewise.ai/threats/cve-2026-106162-in-progress-kendo-ui-for-jquery-versions-starting-with-2023-3) (medium, CVSS 4.7, published 15 Oct 2026) - [CVE-2026-106161: Progress Kendo UI for jQuery Badge text XSS via data binding](https://junglewise.ai/threats/cve-2026-106161-in-progress-kendo-ui-for-jquery-releases-starting-with-v2020-1) (medium, CVSS 5.4, published 15 Oct 2026) - [CVE-2026-106160: Progress Kendo UI for jQuery prototype pollution in Model.accept](https://junglewise.ai/threats/cve-2026-106160-in-progress-kendo-ui-for-jquery-prior-to-2026-3-1015-model) (medium, CVSS 5.4, published 15 Oct 2026) - [CVE-2026-106159: Progress Kendo UI for jQuery XSS via ToolBar ButtonGroup URLs](https://junglewise.ai/threats/cve-2026-106159-in-progress-kendo-ui-for-jquery-versions-starting-with-2022-3) (medium, CVSS 4.7, published 15 Oct 2026) - [CVE-2026-106158: Progress Kendo UI for jQuery Scheduler XSS via resource color](https://junglewise.ai/threats/cve-2026-106158-in-progress-kendo-ui-for-jquery-in-v2026-3-811-and-earlier-the) (medium, CVSS 4.7, published 15 Oct 2026) - [CVE-2026-106157: Progress Kendo UI for jQuery PanelBar XSS in item URLs](https://junglewise.ai/threats/cve-2026-106157-in-progress-kendo-ui-for-jquery-versions-starting-with-2019-2) (medium, CVSS 4.7, published 15 Oct 2026) - [CVE-2026-106148: Progress Kendo UI for jQuery XSS in TabStrip, Menu, and PanelBar](https://junglewise.ai/threats/cve-2026-106148-in-progress-kendo-ui-for-jquery-prior-to-2026-3-1015-the) (medium, CVSS 5.4, published 15 Oct 2026) - [CVE-2026-106147: Progress Kendo UI for jQuery ListBox stored XSS via unencoded dataTextField](https://junglewise.ai/threats/cve-2026-106147-in-progress-kendo-ui-for-jquery-releases-starting-with-r1-2020) (medium, CVSS 5.4, published 15 Oct 2026) ## Most severe Progress Kendo UI for jQuery vulnerabilities - [CVE-2026-108116: Progress Kendo UI for jQuery MDX and SOAP injection in PivotGrid](https://junglewise.ai/threats/cve-2026-108116-in-progress-kendo-ui-for-jquery-prior-to-v2026-3-1015-specially) (high, CVSS 7.5, published 15 Oct 2026) - [CVE-2026-124698: Progress Telerik Kendo UI for jQuery Chart XSS in tooltip](https://junglewise.ai/threats/cve-2026-124698-in-progress-kendo-ui-for-jquery-the-chart-default-tooltip) (high, CVSS 7.1, published 12 Nov 2026) - [CVE-2026-124697: Progress Telerik Kendo UI for jQuery Chart XSS in shared-tooltip](https://junglewise.ai/threats/cve-2026-124697-in-progress-kendo-ui-for-jquery-chart-shared-tooltip-rendering) (high, CVSS 7.1, published 12 Nov 2026) - [CVE-2026-124696: Progress Kendo UI for jQuery Spreadsheet XSS in sheet names](https://junglewise.ai/threats/cve-2026-124696-in-progress-kendo-ui-for-jquery-spreadsheet-sheet-names-are) (high, CVSS 7.1, published 12 Nov 2026) - [CVE-2026-124695: Progress Telerik Kendo UI jQuery Form cross-site scripting in item hints](https://junglewise.ai/threats/cve-2026-124695-in-progress-kendo-ui-for-jquery-form-the-items-hint-option-is) (high, CVSS 7.1, published 12 Nov 2026) - [CVE-2026-124691: Progress Telerik Kendo UI for jQuery Gantt cross-site scripting in Parent dropdown](https://junglewise.ai/threats/cve-2026-124691-in-progress-kendo-ui-for-jquery-gantt-the-task-editor-s-parent) (high, CVSS 7.1, published 12 Nov 2026) - [CVE-2026-124694: Progress Kendo UI for jQuery PropertyGrid XSS in bound values](https://junglewise.ai/threats/cve-2026-124694-in-progress-kendo-ui-for-jquery-versions-2026-3-1015-up-to-but) (high, CVSS 7.1, published 11 Nov 2026) - [CVE-2026-124692: Progress Kendo UI for jQuery XSS in Grid column-reorder drag clue](https://junglewise.ai/threats/cve-2026-124692-in-progress-kendo-ui-for-jquery-versions-2026-3-1015-up-to-but) (high, CVSS 7.1, published 11 Nov 2026) - [CVE-2026-124690: Progress Kendo UI for jQuery DOM-based XSS in SVG icon sanitization](https://junglewise.ai/threats/cve-2026-124690-in-progress-kendo-ui-for-jquery-sanitizesvgcontent-parses-custom) (high, CVSS 7.1, published 11 Nov 2026) - [CVE-2026-124689: Progress Kendo UI for jQuery ActionSheet XSS in header encoding](https://junglewise.ai/threats/cve-2026-124689-in-progress-kendo-ui-for-jquery-versions-2026-3-1014-up-to-but) (high, CVSS 7.1, published 11 Nov 2026) ## Vulnerabilities per week 13 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 13 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 12 | 0 | 0 | ## Other Progress technologies - [Progress Marklogic Server](https://junglewise.ai/threats/technologies/marklogic-server): 41 vulnerabilities - [Progress MOVEit Transfer](https://junglewise.ai/threats/technologies/moveit-transfer): 26 vulnerabilities - [Progress WhatsUp Gold](https://junglewise.ai/threats/technologies/whatsup-gold): 7 vulnerabilities - [Progress LoadMaster](https://junglewise.ai/threats/technologies/loadmaster): 6 vulnerabilities - [Progress Sitefinity](https://junglewise.ai/threats/technologies/sitefinity): 6 vulnerabilities - [Progress ADC](https://junglewise.ai/threats/technologies/adc): 5 vulnerabilities - [Progress Connection Manager for ObjectScale](https://junglewise.ai/threats/technologies/connection-manager-for-objectscale): 5 vulnerabilities - [Progress ECS Connection Manager](https://junglewise.ai/threats/technologies/ecs-connection-manager): 5 vulnerabilities - [Progress Telerik Document Processing Libraries](https://junglewise.ai/threats/technologies/telerik-document-processing-libraries): 5 vulnerabilities - [Progress Telerik Report Server](https://junglewise.ai/threats/technologies/telerik-report-server): 5 vulnerabilities - [Progress ShareFile Storage Zones Controller](https://junglewise.ai/threats/technologies/progress-sharefile-storage-zones-controller): 4 vulnerabilities - [Progress Kendo Ui](https://junglewise.ai/threats/technologies/kendo-ui): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Progress Kendo UI for jQuery vulnerabilities", https://junglewise.ai/threats/technologies/kendo-ui-for-jquery, 12 November 2026.