CVE-2026-106153
Medium
Description
In Progress® Kendo® UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar month content templates render data.url and data.title without proper URL sanitization and HTML attribute encoding. An attacker with low privileges who can control the URL option or culture-derived title values can supply a JavaScript URL or inject event-handler attributes. When a user interacts with an affected calendar, JavaScript can execute in the user's browser context and compromise the confidentiality and integrity of accessible data.
SeverityMedium
CVSS5.4
Exploit probability—
Product
Progress Kendo Ui
PublishedOct 15, 2026
First seenOct 15, 2026
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- progress kendo_ui2026.3.1015 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| progress kendo_ui | 2011.3.1007 ≤ v < 2026.3.1015 | 2026.3.1015 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.