Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: Apache Sling XSS 2.4.12 Clear all filters
TI-2026-62131 CVE-2026-92001 · GHSA-pgm8-c5v3-3mcm

Apache Sling XSS: Missing parser resource limits

Priority LOW 28

Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00573 Published 2026-09-23 Fixed in 2.4.12 CWE-776
TI-2026-51337 CVE-2026-73192 · GHSA-84wv-6469-cpqp

Apache Sling XSS: XSS possible through XSSAPI.getValidHref()

Priority LOW 28

An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability when using the XSSAPI.getValidHref() in Apache Sling XSS version 2.4.10 and prior may allow an attacker to pe…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00573 Published 2026-09-23 Fixed in 2.4.12 CWE-79