CVE-2026-123765

Vendor

Apache Software Foundation

Product

Apache Sling XSS

Weakness

CWE-79

Exposure class

Web platform

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

1. 25
   CVE NVD 1h ago

   Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. xssAPI.getStyleToken()…

   Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. xssAPI.getStyleToken() accepts markup in unquoted urls. This issue affects Apache Sling XSS: before 2.4.14.…

   Fix available CVE-2026-123765 Apache Software Foundation