Apache Software Foundation Sling vulnerabilities

• apache software foundation sling engine Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling CVE-2026-103866 No scoreNovember 5, 2026
• apache software foundation sling engine Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization CVE-2026-103864 No scoreNovember 5, 2026
• apache software foundation sling engine Apache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper paths CVE-2026-103863 No scoreNovember 5, 2026
• apache sling security, apache software foundation sling security bundle +1 more Apache Sling Security Bundle: RefererFilter accepts weaker-than-origin evidence CVE-2026-94243 7.3 HighSeptember 23, 2026
• apache sling security, apache software foundation sling security bundle +1 more Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource CVE-2026-94251 6.5 MediumSeptember 23, 2026
• apache software foundation sling xss, apache sling xss protection api +1 more Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanisms CVE-2026-91928 6.1 MediumSeptember 23, 2026
• apache software foundation sling xss, apache sling xss protection api +1 more Apache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImpl CVE-2026-91852 6.1 MediumSeptember 23, 2026
• apache software foundation sling xss, apache sling xss protection api +1 more Apache Sling XSS: Improper escaping in the XSS Webconsole plugin CVE-2026-91999 6.1 MediumSeptember 23, 2026
• apache software foundation sling xss, apache sling xss protection api +1 more Apache Sling XSS: Missing parser resource limits CVE-2026-92001 6.1 MediumSeptember 23, 2026
• apache software foundation sling xss, apache sling xss protection api +1 more Apache Sling XSS: XSS possible through XSSAPI.getValidHref() CVE-2026-73192 6.1 MediumSeptember 23, 2026
• apache sling servlets resolver Apache Sling Servlets Resolver: Malicious code execution via path traversal CVE-2024-23673 Public exploitFix available 8.5 HighFebruary 6, 2024
• apache sling engine, sling +1 more Apache Sling Engine: Include-based XSS CVE-2022-45064 Fix available 8.0 HighApril 13, 2023
• apache sling resource merger Apache Sling Resource Merger: Requests to certain paths managed by the Apache Sling Resource Merger can lead to DoS CVE-2023-26513 Fix available 7.5 HighMarch 20, 2023
• apache software foundation sling, apache sling i18n +1 more Apache Sling does not allow to handle i18n content in a secure way CVE-2023-25621 Fix available 6.5 MediumFebruary 23, 2023
• apache sling jcr base JNDI injection into Apache sling-org-apache-sling-jcr-base CVE-2023-25141 Fix available 7.5 HighFebruary 14, 2023
• apache software foundation sling app cms, apache sling cms +1 more Apache Sling App CMS: XSS in CMS Reference / UI Components CVE-2023-22849 Fix available 6.1 MediumFebruary 4, 2023
• apache software foundation sling app cms, apache sling cms +1 more Apache Sling App CMS: XSS in CMS Site Group Detail CVE-2022-46769 Fix available 5.4 MediumJanuary 9, 2023
• apache sling cms, apache software foundation sling app cms +1 more XSS in Sling CMS Reference App Taxonomy Path CVE-2022-43670 Fix available 5.4 MediumNovember 2, 2022
• apache sling api, sling commons log, apache software foundation sling +2 more log injection in Sling logging CVE-2022-32549 5.3 MediumJune 22, 2022
• apache sling commons messaging mail SMTPS server hostname not checked when making TLS connection to SMTPS server CVE-2021-44549 Fix available 7.4 HighDecember 14, 2021
• apache sling cms, apache software foundation sling +1 more Scripts in Sling CMS before 0.16.0 do not property escape the Sling Selector from URLs when... CVE-2020-1949 6.1 MediumApril 1, 2020
• apache sling xss protection api, sling xss protection api compat, apache software foundation sling +2 more Cross-site Scripting in Apache Sling XSS Protection API CVE-2017-15717 Fix available 6.1 MediumJanuary 10, 2018
• apache sling jcr contentloader, apache software foundation sling +1 more Apache Sling JCR ContentLoader XmlReader Arbitrary File Load CVE-2012-3353 Fix available 7.5 HighJanuary 8, 2018
• apache sling authentication service, apache software foundation sling +1 more Apache Sling Authentication Service vulnerability CVE-2017-15700 Fix available 8.8 HighDecember 18, 2017
• apache sling XML External Entity Reference in Apache Sling CVE-2016-6798 Public exploitFix available 9.8 CriticalJuly 19, 2017
• apache sling Cross site scripting in Apache Sling CVE-2016-5394 Public exploitFix available 6.1 MediumJuly 19, 2017