Apache Sling XSS
- Software type
- Other
- Total vulnerabilities (90 days)
- 6
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/13/2026, Apache Sling XSS recorded 6 security vulnerabilities in the last 90 days, of which 0 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of Apache Sling XSS and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-123765Apache Sling XSS: xssAPI.getStyleToken() accepts markup in unquoted urls.CVE-2026-92001Apache Sling XSS: Missing parser resource limitsCVE-2026-91999Apache Sling XSS: Improper escaping in the XSS Webconsole pluginCVE-2026-91928Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanismsCVE-2026-91852Apache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImpl| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-123765Apache Sling XSS: xssAPI.getStyleToken() accepts markup in unquoted urls. | Exploitation statusNot confirmed | FixYes | Published11/12/2026 | SeverityUnknown |
CVE-2026-92001Apache Sling XSS: Missing parser resource limits | Exploitation statusNot exploited | FixYes | Published09/23/2026 | SeverityMedium |
CVE-2026-91999Apache Sling XSS: Improper escaping in the XSS Webconsole plugin | Exploitation statusNot exploited | FixYes | Published09/23/2026 | SeverityMedium |
CVE-2026-91928Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanisms | Exploitation statusNot exploited | FixYes | Published09/23/2026 | SeverityMedium |
CVE-2026-91852Apache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImpl | Exploitation statusNot exploited | FixYes | Published09/23/2026 | SeverityMedium |
CVE-2026-73192Apache Sling XSS: XSS possible through XSSAPI.getValidHref() | Exploitation statusNot exploited | FixYes | Published09/23/2026 | SeverityMedium |
6 Results | Page 1 of 1