CVE-2026-13182
High · 7.5CVSS
7.5
EPSS
0.5%
Published
Jul 22, 2026
CISA due date
—
The record
In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failures, creating an oracle that reveals protected metadata values to remote attackers.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-62979 jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer. CWE-209
- CVE-2026-118643 n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 stores credential… CWE-209
- CVE-2026-67080 HCL BigFix AEX is affected by an Information Disclosure vulnerability due to improper… CWE-209
- CVE-2026-118272 A vulnerability was detected in a2ui-project a2ui up to 0.10.6. CWE-209
- CVE-2026-108316 Tanium addressed an information disclosure vulnerability in Tanium Server. CWE-209
- CVE-2026-116478 A vulnerability was detected in a2aproject a2a-go up to 2.4.0. CWE-209
- CVE-2026-116479 A flaw has been found in a2aproject a2a-java up to 1.2.0.Final. CWE-209
- CVE-2026-116477 A security vulnerability has been detected in a2aproject a2a-dotnet up to 1.0.0-preview2. CWE-209