CVE-2026-91999

MEDIO 6.1CVE-2026-91999 · Published 23/09/2026 · updated 30/09/2026

En resumen

CVE-2026-91999 es una vulnerabilidad MEDIO (CVSS 6.1) que afecta a sling xss protection api (apache).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.57%, mayor que el 47.4% de las vulnerabilidades.
Solución: actualizar a 2.4.12 o posterior.

Package	Affected versions	Patched versions
sling xss protection api apache	`< 2.4.12`	`2.4.12`

Description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.

References

lists.apache.org/thread/xpcsdkr80ow9p13f7hp3ykrhzky9d4t4 · Mailing List
openwall.com/lists/oss-security/2026/09/23/14 · Mailing List

Más vulnerabilidades de sling xss protection api

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

sling xss protection api

apache

< 2.4.12

2.4.12

Más vulnerabilidades de sling xss protection api

Ver todo →