kendo ui vulnerabilities and fixes

Recent CVEs affecting kendo ui, with upgrade or downgrade steps. 13 tracked.

Also searched as: kendoui.

kendo ui has 13 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 13. Most recent: 2026-10-15. Highest priority: CVE-2026-108116 (score 36/100).

• CVE-2026-106159 MEDIUM 4.7 UPGRADE In Progress® Kendo® UI for jQuery versions starting with 2022.3.1109 and prior to 2026.3.1015, ToolBar ButtonG
• CVE-2026-106160 MEDIUM 5.4 UPGRADE In Progress® Kendo® UI for jQuery prior to 2026.3.1015, Model.accept passes server-response keys to kendo.sett
• CVE-2026-106161 MEDIUM 5.4 UPGRADE In Progress® Kendo® UI for jQuery releases starting with v2020.1.114 and prior to 2026.3.1015, the Badge text
• CVE-2026-106162 MEDIUM 4.7 UPGRADE In Progress® Kendo® UI for jQuery versions starting with 2023.3.1010 and prior to 2026.3.1015, the FileManager
• CVE-2026-106163 MEDIUM 6.5 UPGRADE In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowse
• CVE-2026-106149 MEDIUM 5.4 UPGRADE In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bo
• CVE-2026-106151 MEDIUM 5.4 UPGRADE In Progress® Kendo® UI for jQuery versions starting with 2012.2.710 and prior to 2026.3.1015, the Validator de
• CVE-2026-106153 MEDIUM 5.4 UPGRADE In Progress® Kendo® UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar month conte
• CVE-2026-108116 HIGH 7.5 UPGRADE In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA t
• CVE-2026-106147 MEDIUM 5.4 UPGRADE In Progress® Kendo® UI for jQuery releases starting with R1 2020 and prior to 2026.3.1015, the ListBox default
• CVE-2026-106148 MEDIUM 5.4 UPGRADE In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the TabStrip, Menu, and PanelBar components insert dat
• CVE-2026-106157 MEDIUM 4.7 UPGRADE In Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar com
• CVE-2026-106158 MEDIUM 4.7 UPGRADE In Progress® Kendo® UI for jQuery, in v2026.3.811 and earlier, the Scheduler Day, Timeline, Month, and Agenda

FAQ

How do I fix kendo ui vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is kendo ui being exploited right now?

None of the tracked kendo ui CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which kendo ui CVE should I patch first?

CVE-2026-108116 currently ranks highest (36/100): In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA t.

RSS feed for kendo ui · ← Back to latest CVEs