Apache Sling XSS

Search everything

Mentions · 7d1
Mentions · 30d1
All mentions6
First seenSep 23, 2026
Last mentioned3h ago

Timeline

6 articles · newest first

Apache Sling XSS before 2.4.14 allows XSS via getStyleToken (CVE-2026-123765)

xssAPI.getStyleToken() accepts markup in unquoted URLs; Apache rates it low and fixes it in 2.4.14.

oss-security17:23 UTC · 3h agoVulnerabilityCVE-2026-123765

CVE-2026-73192: Apache Sling XSS: XSS possible through XSSAPI.getValidHref()

Low-severity reflected XSS vulnerability disclosed in Apache Sling XSS library's getValidHref() method, patched in v2.4.12.

oss-securitySep 23, 15:53 UTC · Sep 23, 2026Vulnerability 7 sourcesCVE-2026-731923 · 1 read

CVE-2026-92001: Apache Sling XSS: Missing parser resource limits

Apache Sling XSS before 2.4.12 has an XML entity expansion vulnerability (CVE-2026-92001).

oss-securitySep 23, 15:45 UTC · Sep 23, 2026Vulnerability 7 sourcesCVE-2026-920013 · 1 read

CVE-2026-91999: Apache Sling XSS: Improper escaping in the XSS Webconsole plugin

Apache Sling XSS before 2.4.12 contains a low-severity cross-site scripting flaw, CVE-2026-91999.

oss-securityupdated Sep 23, 15:53 UTC · Sep 23, 2026first Sep 23, 15:43 UTC · Sep 23, 2026Vulnerability 7 sourcesCVE-2026-919993

CVE-2026-91928: Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanisms

Apache Sling XSS before 2.4.12 has a moderate XSS sanitizer bypass, CVE-2026-91928.

oss-securityupdated Sep 23, 15:53 UTC · Sep 23, 2026first Sep 23, 15:40 UTC · Sep 23, 2026Vulnerability 7 sourcesCVE-2026-919282 · 1 read

CVE-2026-91852: Apache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImpl

Moderate Apache Sling XSS flaw CVE-2026-91852 covers raw-string break-outs and ReDoS in XSSImpl.

oss-securityupdated Sep 23, 15:53 UTC · Sep 23, 2026first Sep 23, 15:38 UTC · Sep 23, 2026Vulnerability 7 sourcesCVE-2026-918521 · 1 read

Related CVEs

by mentions

CVE-2026-919996.1
Cross-Site Scripting in Apache Sling XSS Webconsole Plugin (pre-2.4.12)
published Sep 23, 2026Apache Software Foundation Apache Sling XSS
CVE-2026-920016.1
XML Entity Expansion Flaw in Apache Sling XSS Library Before 2.4.12
published Sep 23, 2026Apache Software Foundation Apache Sling XSS
CVE-2026-731926.1
Reflected XSS in Apache Sling XSS library getValidHref() (<=2.4.10)
published Sep 23, 2026Apache Software Foundation Apache Sling XSS (XSS support library, org.apache.sling.xss)
CVE-2026-919286.1
XSS Sanitizer Bypass in Apache Sling XSS Library (< 2.4.12)
published Sep 23, 2026Apache Software Foundation Apache Sling XSS (org.apache.sling.xss)
CVE-2026-918526.1
Cross-Site Scripting Filter Bypass in Apache Sling XSS before 2.4.12
published Sep 23, 2026Apache Sling XSS
CVE-2026-123765—
published —

Appears with

Apache Software Foundationorganization · 5
Apachevendor · 3
Apache Software Foundationvendor · 3
GPT-6 Astraai model · 1
FBIorganization · 1
Ryukthreat actor · 1
Toyota Corollaproduct · 1
Ryukmalware · 1
Universal Health Servicesorganization · 1
Universal Health Servicesvictim · 1
Trickbotmalware · 1

Entities are extracted by the model from each article. First seen Sep 23, 2026, last mentioned 3h ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.