What’s Vulnerable › Products

Progress Software Telerik UI for ASP.NET AJAX vulnerabilities

23 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 19 published in the last 12 months.

Check whether your Progress Software Telerik UI for ASP.NET AJAX version is affected

Exploited Progress Software Telerik UI for ASP.NET AJAX vulnerabilities

• CVE-2017-11357 — Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability

Latest Progress Software Telerik UI for ASP.NET AJAX vulnerabilities

• CVE-2026-19219 — DialogHandler UploadPaths Tampering Vulnerability in Telerik UI for ASP.NET AJAX (CVSS 8.1)
• CVE-2026-18672 — RadImageEditor ClientState Unauthenticated Arbitrary File Read Vulnerability in Telerik UI for ASP.NET AJAX (CVSS 7.5)
• CVE-2026-14932 — Unauthenticated File Read and Deletion via Hardcoded Encryption Key in RadChart (CVSS 6.5)
• CVE-2026-14865 — XXE Denial of Service via RadLayoutBuilder Client State in Telerik UI for ASP.NET AJAX (CVSS 5.3)
• CVE-2026-13192 — RadEditor PDF Export SSRF Vulnerability in Telerik UI for ASP.NET AJAX (CVSS 6.5)
• CVE-2026-13190 — PersistenceFramework Unsafe Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX (CVSS 8.1)
• CVE-2026-13189 — SpellChecker DictionaryLanguage Path Traversal Vulnerability in Telerik UI for ASP.NET AJAX (CVSS 7.5)
• CVE-2026-13188 — DialogHandler Parameters Tampering Vulnerability in Telerik UI for ASP.NET AJAX (CVSS 5.9)
• CVE-2026-13187 — DialogHandler Provider Type Tampering Vulnerability in Telerik UI for ASP.NET AJAX (CVSS 8.1)
• CVE-2026-13186 — AppDataStorageProvider Path Traversal Deserialization Vulnerability in Telerik UI for ASP.NET AJAX (CVSS 8.1)
• CVE-2026-13185 — PersistenceFramework Cookie Deserialization Vulnerability in Telerik UI for ASP.NET AJAX (CVSS 8.1)
• CVE-2026-13184 — RadAsyncUpload Default HMAC Key Fallback Vulnerability in Telerik UI for ASP.NET AJAX (CVSS 7.5)
• CVE-2026-13183 — RadAsyncUpload Upload Metadata Timing Oracle Vulnerability in Telerik UI for ASP.NET AJAX (CVSS 7.5)
• CVE-2026-13182 — RadAsyncUpload Client-State Decrypt-vs-Parse Oracle Vulnerability in Telerik UI for ASP.NET AJAX (CVSS 7.5)
• CVE-2026-13181 — RadAsyncUpload AsyncUploadTypeName Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX (CVSS 8.1)
• CVE-2026-6023 — Deserialization of Untrusted Data Vulnerability in Telerik UI for ASP.NET AJAX (CVSS 9.8)
• CVE-2026-6022 — Uncontrolled Resource Consumption Vulnerability in Telerik UI for ASP.NET AJAX (CVSS 7.5)
• CVE-2026-2878 — Insufficient Entropy Vulnerability in Telerik UI for ASP.NET AJAX (CVSS 5.9)
• CVE-2025-3600 — Unsafe Reflection Vulnerability in Telerik UI for ASP.NET AJAX (CVSS 7.5)
• CVE-2021-28141 — (CVSS 9.8)
• CVE-2019-19790 — (CVSS 9.8)
• CVE-2017-11357 — Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability (CVSS 9.8) — exploited
• CVE-2014-2217 — (CVSS 7.5)