Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-106163

In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the…

Risk score
40/100
CVSS
6.5 v3.1
Exploit chance (30 days)
0.2%
Published
15 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components render remotely supplied file and directory names as HTML without proper encoding. An attacker-controlled name containing script-related HTML can execute JavaScript in the user's …
Affected
Progress Kendo Ui before 2026.3.1015
Fix
Upgrade Progress Kendo Ui to 2026.3.1015 or later.
Exploitation
No known exploitation

Story map

Story map: Progress Kendo UiTHE FLAWSTHE FIXCVE-2026-106163In Progress® Kendo® UI forjQuery versions starting withv2023.1.117 and prior to…CVSS 6.5 · EPSS 0%CVE-2026-108116InjectionCVSS 7.5 · EPSS 0%Upgrade Progress Kendo Ui2026.3.1015or later on your release lineWho is exposedProgress Kendo Ui before2026.3.1015YELLOW · PLAN IT INProgress Kendo UiIn Progress Kendo UI forjQuery prior to v2026.3.1015,specially crafted filter values inthe PivotGrid XMLA transportcould alter MDX predicates orinject XML markup into SOAPrequests, potentially exposing…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-80 (CWE-80)3 other warnings in 30 days →Same productEarlier Progress Kendo Ui warnings11 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Progress Kendo Ui: Yellow, plan it in. In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection.

The flaws

  • CVE-2026-106163: In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the… (CVSS 6.5 · EPSS 0%)
  • CVE-2026-108116: Injection (CVSS 7.5 · EPSS 0%)

The fix

Upgrade Progress Kendo Ui: 2026.3.1015 or later on your release line

Who is exposed: Progress Kendo Ui before 2026.3.1015

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 6.5 medium

References

Original description

In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components render remotely supplied file and directory names as HTML without proper encoding. An attacker-controlled name containing script-related HTML can execute JavaScript in the user's browser, compromising the confidentiality and integrity of data accessible to the affected application.

Last activity 15 Oct 2026. Patch Forecast updates every hour.