What’s Vulnerable › Vulnerabilities

CVE-2026-78178: jQWidgets jqx-all.js jqxBaseFramework.extend prototype pollution

• Severity: high (CVSS 7.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-24 · updated 2026-10-14
• Weakness: CWE-94

Description

A vulnerability was determined in jQWidgets up to 24.0.1. This affects the function JQXLite.extend/jqxBaseFramework.extend of the file jqwidgets/jqx-all.js. This manipulation causes improperly controlled modification of object prototype attributes. The attack can be initiated remotely. The reported GitHub issue was closed with the label "not planned".

Affected products

• jQWidgets: 24.0.0, 24.0.1

References

• https://github.com/jqwidgets/jQWidgets/
• https://github.com/jqwidgets/jQWidgets/issues/764
• https://vuldb.com/cve/CVE-2026-78178
• https://vuldb.com/submit/884182
• https://vuldb.com/vuln/394562
• https://vuldb.com/vuln/394562/cti

Get alerted when CVE-2026-78178 or the next vulnerability affects your stack