CVE-2026-106160

In Progress® Kendo® UI for jQuery prior to 2026.3.1015, Model.accept passes server-response keys to kendo.setter without guarding against unsafe object paths containing proto, constructor, or prototype. An attacker who can supply data accepted by an affected model can modify object prototype...