CVE-2026-106153 json
Cross-site Scripting (XSS) in Kendo UI for jQuery Calendar and MultiViewCalendar
published 2026-10-15 25 d ago modified 2026-10-20 19 d ago also EUVD-2026-102079
- cvss
- 5.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 7%
- public exploits
- 0
- none known
Summary
In Progress® Kendo® UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar month content templates render data.url and data.title without proper URL sanitization and HTML attribute encoding. An attacker with low privileges who can control the URL option or culture-derived title values can supply a JavaScript URL or inject event-handler attributes. When a user interacts with an affected calendar, JavaScript can execute in the user's browser context and compromise the confidentiality and integrity of accessible data.
Patch / fix
- Progress Software Kendo UI for jQuery 2026.3.1015
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 24 d ago
Exploit prediction
0.18% chance of exploitation in the next 30 days, higher than 7% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Affected products
- Progress Software Kendo UI for jQuery
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
Sources
- CVE List CVE-2026-106153
- NVD CVE-2026-106153
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.