Home / CVEs12 published CVEs
Abhishek Nandkumar Bhaskar — Abhi HackZ , credited in CVE records as Abhi-Hackz — is the credited finder on 12 published CVE records, every one assigned by Progress Software acting as its own CVE Numbering Authority. Click an ID for the full record, affected versions, the fix and the vendor knowledge-base (KB) advisory.
CVE-2026-91140 OS command injection in Progress Software Autonomous REST Connector GenAI AgentsProgress DataDirect · Autonomous REST Connector GenAI Agents (ARCGenAI-Generator) · fixed in 2.1 · Oct 06, 2026 CRITICAL · 9.6 CVE-2026-92931 Server-Side Request Forgery in the Progress Sitefinity Next.js Renderer SDKProgress Sitefinity · @progress/sitefinity-nextjs-sdk (npm) · fixed in 15.4.8638 · Oct 05, 2026 HIGH · 8.8 CVE-2026-106138 Cross-Site Scripting via Chart Tooltip in KendoReactProgress KendoReact · @progress/kendo-react-charts (npm) · fixed in 16.2.0 · Oct 10, 2026 MEDIUM · 5.4 CVE-2026-106139 Cross-Site Scripting via Chart Tooltip in Kendo UI for VueProgress Kendo UI for Vue · @progress/kendo-vue-charts (npm) · fixed in 10.1.0 · Oct 10, 2026 MEDIUM · 5.4 CVE-2026-106147 Cross-Site Scripting via ListBox Bound Text in Kendo UI for jQueryProgress Kendo UI for jQuery · fixed in 2026.3.1015 · Oct 15, 2026 MEDIUM · 5.4 CVE-2026-106148 Cross-Site Scripting via TabStrip, Menu and PanelBar Image URLs in Kendo UI for jQueryProgress Kendo UI for jQuery · fixed in 2026.3.1015 · Oct 15, 2026 MEDIUM · 5.4 CVE-2026-106149 Cross-Site Scripting in the Kendo UI for jQuery Menu componentProgress Kendo UI for jQuery · fixed in 2026.3.1015 · Oct 15, 2026 MEDIUM · 5.4 CVE-2026-106150 Cross-Site Scripting in the Kendo UI for jQuery Splitter, Window and TooltipProgress Kendo UI for jQuery · fixed in 2026.3.1015 · Oct 15, 2026 MEDIUM · 5.4 CVE-2026-106151 Cross-Site Scripting via Validator validation messages in Kendo UI for jQueryProgress Kendo UI for jQuery · fixed in 2026.3.1015 · Oct 15, 2026 MEDIUM · 5.4 CVE-2026-106153 Cross-Site Scripting in the Kendo UI for jQuery Calendar and MultiViewCalendarProgress Kendo UI for jQuery · fixed in 2026.3.1015 · Oct 15, 2026 MEDIUM · 5.4 CVE-2026-106160 Prototype Pollution via Model.accept and kendo.setter in Kendo UI for jQueryProgress Kendo UI for jQuery · fixed in 2026.3.1015 · Oct 15, 2026 MEDIUM · 5.4 CVE-2026-106161 Cross-Site Scripting via Badge text binding in Kendo UI for jQueryProgress Kendo UI for jQuery · fixed in 2026.3.1015 · Oct 15, 2026 MEDIUM · 5.4 How these were disclosed
All of these came in through vendor-run vulnerability disclosure programs on Bugcrowd and were assigned by the vendor acting as its own CVE Numbering Authority. The process is written up in From a Bugcrowd VDP Report to a Published CVE ; the bug classes are explained in Four CVEs in Progress Software Products . Hall of Fame recognitions are on the Hall of Fame page . Findings that don't have a CVE record yet — four OpenMage (Magento LTS) advisories — are on the Security Advisories page .