# Apache Software Foundation Apache Sling XSS.

Every CVE that names Apache Software Foundation Apache Sling XSS among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Apache Sling XSS: xssAPI.getStyleToken() accepts markup in unquoted urls.](https://agentprime.io/advisories/CVE-2026-123765.md)
  `CVE-2026-123765` · CVE record: Apache Software Foundation Apache Sling XSS · No CVSS score · Not analysed yet · Published 12 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanisms](https://agentprime.io/advisories/CVE-2026-91928.md)
  `CVE-2026-91928` · CVE record: Apache Software Foundation Apache Sling XSS · CVSS 6.1 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Apache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImpl](https://agentprime.io/advisories/CVE-2026-91852.md)
  `CVE-2026-91852` · CVE record: Apache Software Foundation Apache Sling XSS · CVSS 6.1 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Apache Sling XSS: Improper escaping in the XSS Webconsole plugin](https://agentprime.io/advisories/CVE-2026-91999.md)
  `CVE-2026-91999` · CVE record: Apache Software Foundation Apache Sling XSS · CVSS 6.1 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Apache Sling XSS: Missing parser resource limits](https://agentprime.io/advisories/CVE-2026-92001.md)
  `CVE-2026-92001` · CVE record: Apache Software Foundation Apache Sling XSS · CVSS 6.1 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Denial of service
- [Apache Sling XSS: XSS possible through XSSAPI.getValidHref()](https://agentprime.io/advisories/CVE-2026-73192.md)
  `CVE-2026-73192` · CVE record: Apache Software Foundation Apache Sling XSS · CVSS 6.1 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS)

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=apache-software-foundation-apache-sling-xss>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/apache-software-foundation-apache-sling-xss/>. Everything for agents: <https://agentprime.io/llms.txt>.