{"metadata": {"vulnerability": "CVE-2026-106154", "count": 11, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 5}, "linked_omitted": 0}, "data": [{"timestamp": "2026-10-06T15:51:11.738Z", "date_only": false, "value": "2026-10-06T15:51:11.738Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-106154", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-12T17:13:26.499Z", "date_only": false, "value": "2026-11-12T17:13:26.499Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-106154", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-12T17:13:26.499Z", "date_only": false, "value": "2026-11-12T17:13:26.499Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-106154", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-12T17:13:26.499Z", "date_only": false, "value": "2026-11-12T17:13:26.499Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / ProgressSoftware", "record": "CVE-2026-106154", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-12T17:20:07.196Z", "date_only": false, "value": "2026-11-12T17:20:07.196995Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117604614577439752", "record": "cve-2026-106154", "field": "creation_timestamp", "uuid": "29bb2edf-86ef-4df7-92c7-3b55bf230b2c", "content": "CVE-2026-106154 Uncontrolled Recursion in Telerik UI for ASP.NET Core FilterParser In Progress\u00ae Telerik\u00ae UI for ASP.NET Core versions `2015.1.318` through `2026.3.1015`, the server-side FilterParser processes nested expressions in untrusted filter parameters through recursive parsing without a recursion-depth limit, while FilterLexer does not enforce an input-length limit. An unauthenticated remote attacker can exploit this if the application exposes an endpoint using DataSourceRequest model binding that is reachable without authentication. Deeply nested filters can trigger parsing errors during model binding or cause `StackOverflowException`. This issue is fixed in version `2026.4.1111`.\nhttps://www.cve.org/CVERecord?id=CVE-2026-106154https://www.telerik.com/aspnet-core-ui/documentation/knowledge-base/kb-security-uncontrolled-recursion-cve-2026-106154#telerik #ProgressSoftware #TelerikUIforASP.NETCore#CVE_2026_106154#bot", "url": "https://infosec.exchange/users/cve/statuses/117604614577439752"}, {"timestamp": "2026-11-12T18:17:12Z", "date_only": false, "value": "2026-11-12T18:17:12Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-WMFM-V59W-H9QP", "record": "GHSA-WMFM-V59W-H9QP", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-12T18:17:12.420Z", "date_only": false, "value": "2026-11-12T18:17:12.420", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-106154", "record": "FKIE_CVE-2026-106154", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-12T18:31:48Z", "date_only": false, "value": "2026-11-12T18:31:48Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-WMFM-V59W-H9QP", "record": "GHSA-WMFM-V59W-H9QP", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-12T18:31:48Z", "date_only": false, "value": "2026-11-12T18:31:48Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-WMFM-V59W-H9QP", "record": "GHSA-WMFM-V59W-H9QP", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-12T19:02:35.830Z", "date_only": false, "value": "2026-11-12T19:02:35.830", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-106154", "record": "FKIE_CVE-2026-106154", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-12T23:29:22.443Z", "date_only": false, "value": "2026-11-12T23:29:22.443561Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3n25mraasiq2m", "record": "CVE-2026-106154", "field": "creation_timestamp", "uuid": "d2f4efa4-0a08-482d-9579-c6095c68197a", "content": "Telerik UI for ASP.NET Core\uff082015.1.318\uff5e2026.3.1015\uff09\u306eFilterParser/Lexer\u306b\u518d\u5e30\u6df1\u3055\u30fb\u5165\u529b\u9577\u5236\u9650\u304c\u306a\u304f\u3001\u8a8d\u8a3c\u306a\u3057\u3067DataSourc\u2026\nCVE-2026-106154 CVSS 8.6 | HIGH", "url": "https://bsky.app/profile/postac001.bsky.social/post/3n25mraasiq2m"}], "metrics": {"as_of": "2026-11-14T03:59:44.980Z", "anchors": {"origin": {"timestamp": "2026-11-12T17:13:26.499Z", "date_only": false, "value": "2026-11-12T17:13:26.499Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-106154", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-12T17:13:26.499Z", "date_only": false, "value": "2026-11-12T17:13:26.499Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-106154", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 125178.48121, "hours": 34.77180033611111, "days": 1.4488250140046297, "min_seconds": 125178.48121, "max_seconds": 125178.48121, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-12T17:13:26.499Z", "date_only": false, "value": "2026-11-12T17:13:26.499Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-106154", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-14T03:59:44.980Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}