CVE-2026-106147

MediumCVSS 5.4/10Last modified Oct 20, 2026

Description

In Progress® Kendo® UI for jQuery releases starting with R1 2020 and prior to 2026.3.1015, the ListBox default item template renders the bound dataTextField value as raw HTML without encoding. An attacker who can modify the bound data can supply HTML containing event handlers that execute JavaScript in a user's browser when the affected list item is rendered. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-80

Affected software

No affected versions have been published.

Timeline

Published
Oct 15, 2026
Last modified
Oct 20, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1061485.4In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the TabStrip, Menu, and PanelBar components insert data source imageUrl values into CVE-2026-1061495.4In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by strinCVE-2026-1061505.4In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the Splitter and Window components starting with version 2011.2.804 and the Tooltip CVE-2026-1061515.4In Progress® Kendo® UI for jQuery versions starting with 2012.2.710 and prior to 2026.3.1015, the Validator decodes validation messages fromCVE-2026-1061535.4In Progress® Kendo® UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar month content templates render data.url aCVE-2026-1061558.9In Progress® Telerik® Report Server prior to version 12.2.26.1007, a stored cross-site scripting vulnerability in the shared reporting enginCVE-2026-1061574.7In Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar component inserts data source iteCVE-2026-1061584.7In Progress® Kendo® UI for jQuery, in v2026.3.811 and earlier, the Scheduler Day, Timeline, Month, and Agenda views insert resource color vaCVE-2026-1061594.7In Progress® Kendo® UI for jQuery versions starting with 2022.3.1109 and prior to 2026.3.1015, ToolBar ButtonGroup button URLs are concatenaCVE-2026-106164.3A weakness has been identified in nextlevelbuilder GoClaw up to 3.11.3. The impacted element is the function TeamTasksTool.executeComplete oCVE-2026-1061605.4In Progress® Kendo® UI for jQuery prior to 2026.3.1015, Model.accept passes server-response keys to kendo.setter without guarding against unCVE-2026-1061615.4In Progress® Kendo® UI for jQuery releases starting with v2020.1.114 and prior to 2026.3.1015, the Badge text method renders string values a
CVE-2026-106147: Medium severity, CVSS 5.4 | Vulnix