CVE-2026-13184
High · 7.5CVSS
7.5
EPSS
0.3%
Published
Jul 22, 2026
CISA due date
—
The record
In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured, upload metadata integrity protection may fall back to a predictable default key, enabling attackers to forge protected upload metadata and unlock further exploit chains.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-61737 ng-antd-admin is an Angular and NestJS administration system template. CWE-321
- CVE-2026-91912 Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Use of Hard-coded… CWE-321
- CVE-2026-119597 OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that… CWE-321
- CVE-2025-62841 An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3… CWE-321
- CVE-2025-62839 An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3… CWE-321
- CVE-2026-86384 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024… CWE-321
- CVE-2026-102812 A hard-coded cryptographic key vulnerability exists in the user-configuration backup… CWE-321
- CVE-2026-117564 nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows… CWE-321