Apache Sling Xss Protection API vulnerabilities

6 CVEs affecting Apache Sling Xss Protection API, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-92001, published 2026-09-23.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-15717, published 2018-01-10. Medium severity, CVSS 6.1. EPSS: 2.9% chance of exploitation in the next 30 days. A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and org.apache.sling.xss.impl.XSSFilterImpl#isValidHref allows special crafted URLs to pass as…
CVE-2026-91852, published 2026-09-23. Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days. Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended…
CVE-2026-92001, published 2026-09-23. Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days. Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended…
CVE-2026-91999, published 2026-09-23. Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days. Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended…
CVE-2026-91928, published 2026-09-23. Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days. Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended…
CVE-2026-73192, published 2026-09-23. Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days. An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability when using the XSSAPI.getValidHref() in Apache Sling XSS version 2.4.10 and prior may…