5 mentions in 7 days · 5 in 30 days · 5 total · first seen · last
Low-severity reflected XSS vulnerability disclosed in Apache Sling XSS library's getValidHref() method, patched in v2.4.12.
A low-severity reflected cross-site scripting (XSS) vulnerability, CVE-2026-73192, has been disclosed in the Apache Sling XSS library. The flaw exists in the XSSAPI.getValidHref() method, potentially allowing script injection. Users are advised to upgrade to version 2.4.12 to mitigate the risk.
Apache Sling XSS before 2.4.12 has an XML entity expansion vulnerability (CVE-2026-92001).
Apache Sling XSS before version 2.4.12 contains a vulnerability (CVE-2026-92001) allowing improper restriction of recursive entity references in DTDs, also known as XML entity expansion. The flaw is tracked as SLING-13336 and was discovered by the Apache Software Foundation. The vendor has released a patch in version 2.4.12 to address the issue.
Apache Sling XSS before 2.4.12 contains a low-severity cross-site scripting flaw, CVE-2026-91999.
Apache disclosed CVE-2026-91999, a cross-site scripting flaw from improper input neutralization in the Apache Sling XSS Webconsole plugin. Versions before 2.4.12 are affected, and users are advised to upgrade to 2.4.12. Apache rates the issue low and tracks it as SLING-13335. The advisory does not say the flaw is being exploited.
Apache Sling XSS before 2.4.12 has a moderate XSS sanitizer bypass, CVE-2026-91928.
Apache Sling XSS before 2.4.12 fails to neutralize input during web page generation, enabling cross-site scripting. The moderate-severity issue also involves sanitizer bypass, uncontrolled resource consumption, and failure of protection mechanisms. Users are advised to upgrade to 2.4.12. It is tracked as SLING-13333 and CVE-2026-91928, with no exploitation reported.
Moderate Apache Sling XSS flaw CVE-2026-91852 covers raw-string break-outs and ReDoS in XSSImpl.
Joerg Hoh posted an oss-security note on CVE-2026-91852 affecting Apache Sling XSS, rated moderate. The flaw is CWE-79 cross-site scripting through multiple raw-string break-outs in XSSImpl, together with regular-expression denial of service. It is tracked as SLING-13334. The short advisory does not give affected versions or say exploitation has been observed.