Apache Sling Xss Protection API
6 CVEs affecting Apache Sling Xss Protection API. Latest disclosed: 2026-09-23. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-92001 | Medium | 6.1 | 2026-09-23 | Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS… |
CVE-2026-91999 | Medium | 6.1 | 2026-09-23 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS… |
CVE-2026-91928 | Medium | 6.1 | 2026-09-23 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS… |
CVE-2026-91852 | Medium | 6.1 | 2026-09-23 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS… |
CVE-2026-73192 | Medium | 6.1 | 2026-09-23 | An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability when using the XSSAPI.getValidHref() in Apache S… |
CVE-2017-15717 | Medium | 6.1 | 2018-01-10 | A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and org.apache.sling.xss.impl.XSSFilterImpl#isValidHref… |