SEPTEMBER 30, 2026
Live Feed
Back to database
Case File

CVE-2026-91999

MEDIUM · CVSS 6.1 EPSS 0.17%

Source: NVD + CISA KEV + EPSS · Published 2026-09-23 · Last synced 2026-09-30

CyberRota Analysis

AI-Generated

Apache Sling XSS versions prior to 2.4.12 are vulnerable to a cross-site scripting (XSS) flaw due to improper input neutralization during web page generation. This vulnerability could allow attackers to inject malicious scripts, potentially compromising user data and session integrity. Organizations using affected versions should prioritize upgrading to 2.4.12 to mitigate the risk of exploitation.

CVE
CVE-2026-91999
Severity
MEDIUM
CVSS
6.1
EPSS
0.17%
Apache

Original NVD Description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.

Related CVEs

Other vulnerabilities affecting the same vendor(s)

CVE-2026-92001 MEDIUM CVE-2026-91928 MEDIUM CVE-2026-91852 MEDIUM CVE-2026-73192 MEDIUM CVE-2026-86473 CRITICAL CVE-2026-82355 MEDIUM