AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Progress SoftwareCVE-2026-14932

Progress Software Telerik UI for ASP.NET AJAX: hard-coded key

Progress Software

CVE-2026-14932 · Published Jul 22, 2026 · updated Aug 6, 2026

Medium6.5
Fix: upgrade to 2026.2.708 or later
Progress Software advisory

In Progress® Telerik® UI for AJAX prior to v2026.2.708, the obsolete RadChart component's ChartImage.axd handler is vulnerable to unauthenticated file read and deletion of image-extension files within the application directory.

Affected versions

PackageAffectedFixed in
Telerik UI for ASP.NET AJAX
Product
>= 2009.1.311, < 2026.2.7082026.2.708
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-321

More Progress Software advisories

All Progress Software
Medium 5.3Jul 22Progress Software Telerik UI for ASP.NET AJAX: denial of serviceCVE-2026-14865fixed in 2026.2.708High 8.1Jul 22Progress Software Telerik UI for ASP.NET AJAX: remote code executionCVE-2026-13185fixed in 2026.2.708High 8.1Jul 22Progress Software Telerik UI for ASP.NET AJAX: path traversalCVE-2026-13186fixed in 2026.2.708High 8.1Jul 22In Progress Telerik UI for AJAX prior to v2026.2.708CVE-2026-13187fixed in 2026.2.708Medium 5.9Jul 22Progress Software Telerik UI for ASP.NET AJAX: insufficient authenticity checkCVE-2026-13188fixed in 2026.2.708High 7.5Jul 22Progress Software Telerik UI: attacker could influence server-side file path...CVE-2026-13189fixed in 2026.2.708