Sling Xss Protection Api (Apache) - vulnerabilities (CVEs)

6 CVEs, 0 in the last 30 days, 31 known versions, newest CVE from 2026-09-23. Vendor: Apache.

CVEs of Sling Xss Protection Api

• CVE-2026-91928 - CVSS 6.1 (medium), 2026-09-23: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS:…
• CVE-2026-91852 - CVSS 6.1 (medium), 2026-09-23: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS:…
• CVE-2026-91999 - CVSS 6.1 (medium), 2026-09-23: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS:…
• CVE-2026-92001 - CVSS 6.1 (medium), 2026-09-23: Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS:…
• CVE-2026-73192 - CVSS 6.1 (medium), 2026-09-23: An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability when using the XSSAPI.getValidHref() in Apache…
• CVE-2017-15717 - CVSS 6.1 (medium), 2018-01-10: A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and…