CVE-2026-92001

Improper restriction of recursive entity references in DTDs 'XML entity expansion' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...

CVE-2026-91928

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...

CVE-2026-91999

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...

CVE-2026-73192

An improper neutralization of input during web page generation 'Cross-site Scripting' CWE-79 vulnerability when using the XSSAPI.getValidHref in Apache Sling XSS version 2.4.10 and prior may allow an attacker to perform a reflected cross-site scripting XSS attack in every feature using this metho...

CVE-2026-91852

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...

EUVD-2026-85179

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...

CVE-2026-91928 Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanisms

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...

EUVD-2026-85176

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...

CVE-2026-91852 Apache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImpl

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...

CVE-2026-91999 Apache Sling XSS: Improper escaping in the XSS Webconsole plugin

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...

EUVD-2026-85175

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...

CVE-2026-92001 Apache Sling XSS: Missing parser resource limits

Improper restriction of recursive entity references in DTDs 'XML entity expansion' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...

EUVD-2026-85174

Improper restriction of recursive entity references in DTDs 'XML entity expansion' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...

CVE-2026-92001

The Apache Sling XSS component is vulnerable to an XML entity expansion issue due to improper restriction of recursive entity references in DTDs. This vulnerability affects versions before 2.4.12 . To remediate this issue, users are recommended to upgrade to version 2.4.12 , which provides the fi...

CVE-2026-73192 Apache Sling XSS: XSS possible through XSSAPI.getValidHref()

An improper neutralization of input during web page generation 'Cross-site Scripting' CWE-79 vulnerability when using the XSSAPI.getValidHref in Apache Sling XSS version 2.4.10 and prior may allow an attacker to perform a reflected cross-site scripting XSS attack in every feature using this metho...

EUVD-2026-85173

An improper neutralization of input during web page generation 'Cross-site Scripting' CWE-79 vulnerability when using the XSSAPI.getValidHref in Apache Sling XSS version 2.4.10 and prior may allow an attacker to perform a reflected cross-site scripting XSS attack in every feature using this metho...

CVE-2026-73192

A reflected Cross-site Scripting (XSS) vulnerability exists in Apache Sling XSS version 2.4.10 and prior . The root cause is an improper neutralization of input during web page generation when utilizing the XSSAPI.getValidHref() method. An attacker can exploit this by submitting values that are n...

apache__sling-org-apache-sling-xss_CVE-2016-5394_1-0-8

Apache Sling XSS Bundle The Apache Sling XSS Bundle provides two services for escaping and filtering XSS-prone user submitted content: 1. org.apache.sling.xss.XSSAPI 2. org.apache.sling.xss.XSSFilter Please check the JavaDoc of each service to find out what methods they provide...

APSB18-04 Security updates available for Adobe Experience Manager

Adobe has released security updates for Adobe Experience Manager. These updates resolve a reflected cross-site scripting vulnerability CVE-2018-4875 rated moderate, and a cross-site scripting vulnerability CVE-2018-4876 in Apache Sling XSS protection API rated important...