CVE-2026-123765: Apache Sling XSS: SLING-13406

Summary by Cyber Security News11 Nov 2026, 18:23 CET

About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/671

Posted by Joerg Hoh on Nov 11 Severity: low Affected versions: - Apache Sling XSS before 2.4.14 Description: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. xssAPI.getStyleToken() accepts markup in unquoted urls. This issue affects Apache Sling XSS: before 2.4.14. Users are recommended to upgrade to version 2.4.14, which fixes the issue.

Read the full article at oss-security →

Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

PostgreSQL 18.7, 17.12, 16.16, 15.20, 14.25, and 19 RC 2 Released, fixes 52 security vulnerabilities

Apache TomEE: 38 CVEs addressed in 10.3.0 and 11.0.0-M2 (combined announcement)

CVE-2026-124023: Apache Axis2/C: Out-of-bounds read in the Guththila XML reader wrapper

Re: Node.js security release pre-alert

CVE-2026-49236: Apache XML Graphics Batik: SVG color-profile xml:base bypasses Batik external resource same-origin checks

CVE-2026-40853: Apache XML Graphics Batik: Cross-Site Scripting via Unencoded Font Metadata in Apache Batik SVGFont