CVE-2026-106153

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-106153

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-106153.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-106153

Published

2026-10-15T14:12:05Z

Modified

2026-10-28T02:30:24Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Cross-site Scripting (XSS) in Kendo UI for jQuery Calendar and MultiViewCalendar

Details

In Progress® Kendo® UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar month content templates render data.url and data.title without proper URL sanitization and HTML attribute encoding. An attacker with low privileges who can control the URL option or culture-derived title values can supply a JavaScript URL or inject event-handler attributes. When a user interacts with an affected calendar, JavaScript can execute in the user's browser context and compromise the confidentiality and integrity of accessible data.

Database specific

{
    "cna_assigner":  "ProgressSoftware",
    "cwe_ids":  [
        "CWE-79"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106153.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "2011.3.1007"
                        },
                        {
                            "fixed":  "2026.3.1015"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StandardRange"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/telerik/kendo-ui-core

Affected ranges

Type

GIT

Repo

https://github.com/telerik/kendo-ui-core

Events

Introduced

92b74196ef1385f3798ca8186e7ce834eeabd3cd

Fixed

c324e79576cc977b9f40e8a56f8ab1ccae4a10cf

Database specific

Show details

{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:progress:kendo_ui:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "2011.3.1007"
                },
                {
                    "fixed":  "2026.3.1015"
                }
            ],
            "source":  "CPE_RANGE"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-106153.json"