Apache Sling Xss Protection Api — known CVE vulnerabilities

Every CVE whose affected-product data names Apache Sling Xss Protection Api, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (6)

• CVE-2017-15717 — CVSS 6.1 (medium): A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and org.apache.sling.xss.impl.XSSFil…
• CVE-2026-73192 — CVSS 6.1 (medium): An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability when using the…
• CVE-2026-91852 — CVSS 6.1 (medium): Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects…
• CVE-2026-91928 — CVSS 6.1 (medium): Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects…
• CVE-2026-91999 — CVSS 6.1 (medium): Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects…
• CVE-2026-92001 — CVSS 6.1 (medium): Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS. This issue affects…