Is CVE-2026-106158 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-106158 being exploited in the wild.

How severe is CVE-2026-106158?

Medium severity, with a CVSS score of 4.7, published 15 October 2026.

Which products and versions are affected?

Progress Kendo UI for jQuery 2014.3.1119 through 2026.3.811.

Is there a fix for CVE-2026-106158?

Yes: fixed in 2026.3.1015. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-106158 attacked?

It is attacked over the network.

Am I affected by CVE-2026-106158?

Check whether you run Progress Kendo UI for jQuery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106158: Progress Kendo UI for jQuery Scheduler XSS via resource color

CVE-2026-106158 · Severity: medium · CVSS 4.7 · Published 2026-10-15

Progress Kendo UI for jQuery is a library for building interactive web applications with UI components. The Scheduler component fails to encode resource color values when rendering events, allowing an attacker who controls resource colors to inject malicious code that executes when users interact with scheduled events. This can lead to data theft or unauthorized actions performed in the context of the affected user's session.

Technologies: Progress Kendo UI for jQuery. Vendors: Progress.

Quick answers

Is CVE-2026-106158 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-106158 being exploited in the wild.
How severe is CVE-2026-106158?: Medium severity, with a CVSS score of 4.7, published 15 October 2026.
Which products and versions are affected?: Progress Kendo UI for jQuery 2014.3.1119 through 2026.3.811.
Is there a fix for CVE-2026-106158?: Yes: fixed in 2026.3.1015. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106158 attacked?: It is attacked over the network.
Am I affected by CVE-2026-106158?: Check whether you run Progress Kendo UI for jQuery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2026.3.1015

Technical details

A reflected cross-site scripting (XSS) vulnerability exists in the Scheduler Day, Timeline, Month, and Agenda views where resource color values are inserted into HTML attributes without proper encoding. An attacker with control over resource color configuration can inject additional HTML attributes including event handlers to execute arbitrary JavaScript. The vulnerability requires user interaction with the affected event and an attacker-controlled resource color value.

Affected products

Progress Kendo UI for jQuery 2014.3.1119 through 2026.3.811

Timeline

2026-10-15: disclosed
2026-10-14: advisory

References

https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-scheduler-resource-color-xss-cve-2026-106158

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.