CVE-2026-124701

HighCVSS 7.8/10Last modified Nov 12, 2026

Description

In Telerik UI for WinForms, versions prior to 2026.4.1111, a deserialization of untrusted data vulnerability exists that allows an attacker to perform unauthorized actions in the context of the affected application.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 12, 2026
Last modified: Nov 12, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1247027.8In Telerik UI for WPF, versions prior to 2026.4.1110, an untrusted URL redirection vulnerability exists that allows an attacker to launch ar CVE-2026-1247037.8In Telerik UI for WPF, versions prior to 2026.4.1110, an improper control of code generation vulnerability exists that allows an attacker to CVE-2026-1247047.8In Telerik UI for WPF, versions prior to 2026.4.1110, a deserialization of untrusted data vulnerability exists that allows an attacker to pe CVE-2026-1247057.8In Progress® Telerik® UI for .NET MAUI prior to version 16.0.0, an untrusted URL redirection vulnerability in the RadRichTextEditor hyperlin CVE-2026-124714.3The Spexo theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the activate_plugin function in all CVE-2026-124725.3The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions u CVE-2026-124738.2Two data sources (DICOMWebProxy and DICOMJSON) shipped in the default configuration fetch an arbitrary URL parameter without validation. A g CVE-2026-1247377.5A flaw was found in BusyBox. When the TFTP (Trivial File Transfer Protocol) client requests a custom small block size and receives a standar CVE-2026-1247385.3A flaw was found in BusyBox. When the HTTP daemon (httpd) has pre-compressed file support enabled, authentication checks are evaluated only CVE-2026-1247397.5A flaw was found in BusyBox. When the httpd web server processes subdirectory configuration files, an overly long index page name can trigge CVE-2026-1247404.3A flaw was found in BusyBox's udhcpc6 DHCPv6 client. A malicious server on the local network can trigger a use-after-free condition by respo CVE-2026-1247417.6A flaw was found in BusyBox. The udhcpc6 DHCPv6 client does not properly validate the size of network options sent by a server before copyin