PULSE
EN
FEED
ransomqilin reclama a Telcoe Federal Credit Union · US · Financial Servicesransomwallstreet reclama a TGM Manufacturing, Inc · US · Manufacturingransomqilin reclama a Segres Systec · ES · Technologyransomqilin reclama a Shield Wall Systems of Florida · US · Government & Defenseransomqilin reclama a The Excalibur Group · US · Otherransomiah6477 reclama a hilmar-cheese · US · Agriculture and Food Productionransomn0n reclama a Company #70 · EG · Not Foundransomn0n reclama a Company #73 · Not Foundransomlockbit5 reclama a torcivialaw.com · IT · Professional Servicesransomlockbit5 reclama a kidzrkooldental.com · US · Healthcareransomlockbit5 reclama a lcww.com.eg · EG · Not Foundransomlockbit5 reclama a neweramachines.com · US · Manufacturingransomlockbit5 reclama a grupoabg.com · MX · Manufacturingransomqilin reclama a KD Corp · KR · Not Foundransomqilin reclama a Telcoe Federal Credit Union · US · Financial Servicesransomwallstreet reclama a TGM Manufacturing, Inc · US · Manufacturingransomqilin reclama a Segres Systec · ES · Technologyransomqilin reclama a Shield Wall Systems of Florida · US · Government & Defenseransomqilin reclama a The Excalibur Group · US · Otherransomiah6477 reclama a hilmar-cheese · US · Agriculture and Food Productionransomn0n reclama a Company #70 · EG · Not Foundransomn0n reclama a Company #73 · Not Foundransomlockbit5 reclama a torcivialaw.com · IT · Professional Servicesransomlockbit5 reclama a kidzrkooldental.com · US · Healthcareransomlockbit5 reclama a lcww.com.eg · EG · Not Foundransomlockbit5 reclama a neweramachines.com · US · Manufacturingransomlockbit5 reclama a grupoabg.com · MX · Manufacturingransomqilin reclama a KD Corp · KR · Not Found
← Todos los CVEs
CVE Watch15 oct 2026

CVE-2026-106160

In Progress® Kendo® UI for jQuery prior to 2026.3.1015, Model.accept passes server-response keys to kendo.setter without guarding against un

CVSS

5.4

Medio

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 15 oct 2026 · Última mod.: 15 oct 2026 · CWE-1321

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

In Progress® Kendo® UI for jQuery prior to 2026.3.1015, Model.accept passes server-response keys to kendo.setter without guarding against unsafe object paths containing __proto__, constructor, or prototype. An attacker who can supply data accepted by an affected model can modify object prototype attributes and influence application behavior, potentially compromising the confidentiality and integrity of application data. The impact depends on how the application uses the modified objects, including in server-side JavaScript scenarios. The earliest affected version has not been confirmed. This issue is fixed in version 2026.3.1015.

Referencias oficiales
CVEs relacionados
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1111725.3 MED
—
———@casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in rulesToFields() that allows attackers to modify inherited builtins via dotted condition keys. Attackers controlling rule conditions can supply keys like 'toString.call' to alter shared builtin functions process-wide, causing denial of service for the Node.js process.7hCVE-2026-110848—
—
——0n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the AI workflow builder, which merges workflow connections using node names as object members without checking for reserved keys. Authenticated users can create nodes named __proto__ through the API and invoke the connect-nodes operation to pollute the global object prototype, disrupting the instance until restart.1dCVE-2026-110842—
—
——0n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the MCP workflow-validation tool, whose interpreter evaluates caller-supplied code in the main process, reads inherited properties, and permits assignment onto shared prototypes. An authenticated member holding only a workflow:read grant can replace a built-in method with one returning a truthy value so server-side permission checks accept unheld scopes, enabling takeover of owner accounts not protected by MFA.12hCVE-2026-1101117.5 ALT
48.3%
——15Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at a malicious ESXi host serving a crafted .vmx file with __proto__.permission set, polluting Object.prototype so permission-less accounts inherit admin rights and enabling remote code execution.2dCVE-2026-109758—
43.2%
——13Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint is reachable by an attacker. In affected versions of HAS, the installation templates contain a default credential which the installer copies into the active configuration; the installer and configuration script do not automatically replace that value with a random token. An attacker who knows the default token can authenticate to the SCIM API and perform user and group operations allowed by the configured provisioning backend. This issue can be chained with CVE-2026-61834 in affected releases of the scim-patch dependency. This vulnerability exists in version 2022.1 - 2025.2 of HAS however the underlying defect was removed in version 2026.1 which was released July 17th 2026. The vulnerability was identified in older versions of HAS after version 2026.1 was released.9hCVE-2021-480128.2 ALT
34.1%
——10fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying TOML containing __proto__, constructor or prototype key segments. Attackers can pass [__proto__] or [constructor.prototype] table headers or __proto__.x dotted keys to parse() to pollute all objects, causing denial of service or authorization bypass.3d