CVE-2026-92001

Improper restriction of recursive entity references in DTDs 'XML entity expansion' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...

CVE-2026-91928

The Apache Sling XSS component is vulnerable to a cross-site scripting (XSS) issue caused by the improper neutralization of input during web page generation. This vulnerability affects versions prior to 2.4.12 . The CVSS 3.1 score is 6.1 (MEDIUM) , indicating that while exploitation requires user...

EUVD-2026-85176

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...

CVE-2026-91999

The Apache Sling XSS component (versions before 2.4.12 ) is vulnerable to a cross-site scripting (XSS) flaw due to improper neutralization of input during web page generation. This vulnerability could allow an attacker to execute scripts in a user's browser session. To remediate this issue, users...