Progress Telerik UI for AJAX vulnerabilities
5 known CVE vulnerabilities in Progress Telerik UI for AJAX, translated and rated.
- CVE-2026-6023High
The RadFilter control in Progress® Telerik® UI for AJAX versions 2024.4.1114 through 2026.1.421 is vulnerable to insecure deserialization when restoring filter state if the state is exposed to the client.
- CVE-2026-13190High
A deserialization vulnerability in Progress Telerik UI for AJAX (prior to v2026.2.708) allows unsafe type instantiation from attacker-influenced persisted state.
- CVE-2026-13189High
In Progress Telerik UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in the spell check handler may allow an attacker to influence server-side file path resolution and trigger unintended server-side requests.
- CVE-2026-13185High
In Progress Telerik UI for AJAX (prior to v2026.2.708), applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize attacker-controlled cookie content.
- CVE-2026-13181High
In Progress Telerik UI for AJAX (prior to v2026.2.708), forged upload metadata influences AsyncUploadTypeName processing, enabling unsafe type resolution.