P4Verified

CVE-2026-106150: Kendo UI for jQuery 2013.1.319 to before 2026.3.1015, 2011.2.804 to before 2026.3.1015

CVE-2026-106150. CVSS 3.1 base score 5.4 (MEDIUM, Vendor/CNA).

Affected technology

Kendo UI for jQuery · 2013.1.319 to before 2026.3.1015, 2011.2.804 to before 2026.3.1015
Progress Software

Description’s affected range: prior to 2026.3.1015

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · User interaction required

What an attacker can do

An attacker with low privileges who can control these values can inject HTML attributes, including JavaScript event handlers, through an apostrophe in an iframe URL or a crafted title. Vendor/CNA’s CVSS 3.1 assessment (base score 5.4/10) rates confidentiality and integrity impact as low; availability impact as none.

Published 15-Oct-2026 18:55 UTC

CWE: CWE-79
CCR priority: 21.6 /100 (P4)
CVSS 3.1: 5.4 /10 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · Vendor/CNA
KEV: no

Provenance

GitHub Advisory Database · Source record · observed 2026-10-15 18:59:14.583303+00:00 UTC
NVD CVE API 2.0 · Source record · observed 2026-10-15 20:17:11.213245+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-106150.html