CVE-2026-106162

MediumCVSS 4.7/10Last modified Oct 20, 2026

Description

In Progress® Kendo® UI for jQuery versions starting with 2023.3.1010 and prior to 2026.3.1015, the FileManager component renders remotely supplied item names as HTML in its default drag hint even though the corresponding list items are encoded. An attacker who can control an item name can inject HTML containing event handlers that execute JavaScript in a user's browser when the user drags the affected item. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-80

Affected software

No affected versions have been published.

Timeline

Published: Oct 15, 2026
Last modified: Oct 20, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1061636.5In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components CVE-2026-1061647.3In Progress® Telerik® Document Processing SpreadProcessing library, versions prior to 2026.3.1006, an infinite loop vulnerability exists whe CVE-2026-1061665.3The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stor CVE-2026-106177.3A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. This affects the function resolveAuth of the file intern CVE-2026-1061704.9An Uncaught Exception vulnerability [CWE-248] vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, CVE-2026-1061716.1A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiManager 8.0.0, F CVE-2026-1061725.3A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSan CVE-2026-1061739.8A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacke CVE-2026-1061752.3A Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.7, FortiOS 7.4 all versions, FortiOS 7.2 all versi CVE-2026-1061763.8A missing authorization vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via Specially CVE-2026-1061776.4A kernel buffer overflow vulnerability in HP Sure Click versions prior to 4.4.33 may allow local privilege escalation or arbitrary code exec CVE-2026-1061795.4UI misrepresentation in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted