Marcio Almeida

**Name of the Vulnerable Software and Affected Versions** Telerik UI for AJAX versions prior to 2026.3.812 **Description** Insufficient integrity protection of dialog request parameters used by the RadEditor file browser may allow an attacker who has obtained certain application encryption key material to alter the folders the file browser reads from, writes to, and uploads into, potentially resulting in remote code execution. **Recommendations** Update Telerik UI for AJAX to version 2026.3.812 or later.

**Name of the Vulnerable Software and Affected Versions** Telerik UI for AJAX versions prior to 2026.3.812 **Description** Insufficient validation of client-supplied state in the RadImageEditor control allows an attacker to influence which file is returned by the image cache. This can lead to the exposure of file contents located outside the intended image directories. **Recommendations** Update to version 2026.3.812 or later.

**Name of the Vulnerable Software and Affected Versions** Telerik UI for AJAX versions prior to 2026.2.708 **Description** The RadAsyncUpload component contains a flaw in client-state processing where the system can distinguish between decryption failures and invalid-JSON parse failures. This behavior creates a decryption oracle, allowing remote attackers to reveal protected metadata values. **Recommendations** Update to version 2026.2.708.

**Name of the Vulnerable Software and Affected Versions** Telerik UI for AJAX versions prior to 2026.2.708 **Description** The RadAsyncUpload component contains a timing side-channel issue during the processing of upload metadata. This allows remote attackers to recover protected metadata values by analyzing measurable timing differences to determine cryptographic validity. **Recommendations** Update to version 2026.2.708 or later.

**Name of the Vulnerable Software and Affected Versions** Telerik UI for AJAX versions prior to 2026.2.708 **Description** When the `Telerik.Upload.ConfigurationHashKey` is absent and the `machineKey` is not explicitly configured, the integrity protection for upload metadata may revert to a predictable default key. This allows attackers to forge protected upload metadata, which can be used to facilitate further exploit chains. **Recommendations** Update Telerik UI for AJAX to version 2026.2.708 or later. Explicitly configure the `machineKey` or provide a `Telerik.Upload.ConfigurationHashKey` to ensure metadata integrity.

**Name of the Vulnerable Software and Affected Versions** Telerik UI for AJAX versions prior to 2026.2.708 **Description** Input provided to the `DialogHandler` provider type can be tampered with, which may allow an attacker to alter how dialogs are processed and potentially enable chained exploitation. **Recommendations** Update Telerik UI for AJAX to version 2026.2.708 or later.

**Name of the Vulnerable Software and Affected Versions** Telerik UI for AJAX versions prior to 2026.2.708 **Description** Forged upload metadata can influence the processing of `AsyncUploadTypeName`, leading to unsafe attacker-controlled type resolution. This flaw allows for remote code execution in affected deployments. **Recommendations** Update Telerik UI for AJAX to version 2026.2.708 or later.

**Name of the Vulnerable Software and Affected Versions** Telerik UI for AJAX versions prior to 2026.2.708 **Description** Insufficient validation of content submitted to the RadEditor PDF export feature allows an authenticated attacker to trigger server-side requests to arbitrary hosts. This can lead to outbound network connections and the potential exposure of Windows authentication credentials. **Recommendations** Update to version 2026.2.708 or later.

**Name of the Vulnerable Software and Affected Versions** Telerik UI for AJAX versions prior to 2026.2.708 **Description** The internal LayoutBuilder control processes client-state XML without disabling Document Type Definition (DTD) processing. This allows an unauthenticated attacker to cause a denial of service through recursive XML entity expansion, a technique where nested entities are used to exhaust system resources. **Recommendations** Update to version 2026.2.708 or later.

**Name of the Vulnerable Software and Affected Versions** Telerik UI for AJAX versions prior to 2026.2.708 **Description** The obsolete RadChart component contains a flaw in the 'ChartImage.axd' endpoint that allows unauthenticated users to read and delete files with image extensions located within the application directory. **Recommendations** Update to version 2026.2.708 or later. As a temporary mitigation, restrict access to the 'ChartImage.axd' handler or disable the RadChart component.

**Name of the Vulnerable Software and Affected Versions** Telerik UI for AJAX versions prior to 2026.2.708 **Description** Request parameters within the 'DialogHandler' may be tampered with, which could allow an attacker to alter the server-side behavior of dialogs and facilitate chained exploitation. **Recommendations** Update to version 2026.2.708.

**Name of the Vulnerable Software and Affected Versions** Telerik UI for AJAX versions prior to 2026.2.708 **Description** Insufficient validation of the `language` parameter in the spell check handler allows an attacker to influence server-side file path resolution. This can lead to the triggering of unintended server-side requests. **Recommendations** Update to version 2026.2.708 or later. Restrict use of the `language` parameter in the spell check handler until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Kong Insomnia Desktop Application versions prior to 11.0.2 **Description** The Kong Insomnia Desktop Application is susceptible to a template injection issue. This flaw stems from inadequate validation of user-provided input during template string processing, potentially enabling attackers to execute arbitrary JavaScript code within the application's context. The vulnerability allows for remote code execution via cookies and imports. **Recommendations** Versions prior to 11.0.2 should be updated to version 11.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** macOS Sonoma versions 14.0 through 14.5 macOS Monterey versions 12.0 through 12.7.5 macOS Ventura versions 13.0 through 13.6.7 **Description** The issue allows a shortcut to potentially bypass sensitive Shortcuts app settings. This is addressed by adding an additional prompt for user consent. The vulnerability may enable arbitrary command execution and file leaks across all Apple devices. **Recommendations** For macOS Sonoma versions 14.0 through 14.5, update to macOS Sonoma 14.6. For macOS Monterey versions 12.0 through 12.7.5, update to macOS Monterey 12.7.6. For macOS Ventura versions 13.0 through 13.6.7, update to macOS Ventura 13.6.8.

**Name of the Vulnerable Software and Affected Versions** Dompdf versions prior to 2.0.1 **Description** The issue allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a `@font-face` rule. This is related to the `registerFont` function in `FontMetrics.php`. **Recommendations** For versions prior to 2.0.1, update to version 2.0.1 or later to resolve the issue. As a temporary workaround, consider disabling the `registerFont` function in `FontMetrics.php` to prevent remote file inclusion until a patch is applied. Restrict access to the `FontMetrics.php` file to minimize the risk of exploitation. Avoid using the `@font-face` rule in affected API endpoints until the issue is resolved.