CVE-2026-103863 Apache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper paths

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling Engine. Content-Type, charset, and redirect changes from an included component evade the protectheaders / checkcontenttype enforcement through setHeader, repeated calls to...