CVE-2026-103863

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling Engine. Content-Type, charset, and redirect changes from an included component evade the protectheaders / checkcontenttype enforcement through setHeader, repeated calls to...