Threats affecting pkg:maven/org.apache.sling/sling-xss

2 threats

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	6.1	EPSS 0.6%	CVE-2026-91928Apache Sling XSS · Cross-site Scripting Medium6.1EPSS 0.6%2026-09-23CVE Database V5CVE-2026-91928 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue. EPSS 0.6%Vulnerability Apache Software Foundation CWE-79	CVE Database V5	2026-09-23
Medium	6.1	EPSS 0.6%	CVE-2026-92001Apache Sling XSS · XML Entity Expansion Medium6.1EPSS 0.6%2026-09-23CVE Database V5CVE-2026-92001 Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue. EPSS 0.6%Vulnerability Apache Software Foundation CWE-776	CVE Database V5	2026-09-23

Page 1 of 1