CVE-2026-91928

MediumCVSS 6.1/10Last modified Sep 30, 2026

Description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS.

This issue affects Apache Sling XSS: before 2.4.12.

Users are recommended to upgrade to version 2.4.12, which fixes the issue.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Sep 23, 2026
Last modified
Sep 30, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-919297.1Flowise versions before 3.1.4 contain cross-tenant authorization gaps in Enterprise endpoints that fail to verify resource ownership before CVE-2026-91939.9An improper privilege management vulnerability in the Hadoop integration of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an autCVE-2026-919307.5Flowise before 3.1.4 fails to scope enterprise organization and workspace membership APIs to the caller's tenant, allowing authenticated useCVE-2026-919318.5Flowise before 3.1.4 contains a remote code execution vulnerability in the Custom MCP node that allows authenticated attackers to execute arCVE-2026-919328.5Flowise before 3.1.4 contains a validation bypass vulnerability in MCP server configuration allowing authenticated attackers remote code exeCVE-2026-919337.1Flowise before 3.1.4 fails to enforce workspace-level authorization checks in openai-realtime endpoints, allowing authenticated users to accCVE-2026-919348.8Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when connecting to SQLite databases, allowing autheCVE-2026-919358.3Flowise before 3.1.4 fails to validate baseURL parameters in chat-model nodes, allowing authenticated users to redirect requests to arbitrarCVE-2026-919366.8Flowise versions before 3.1.4 contain a script injection vulnerability in Docker image build workflows where workflow_dispatch inputs are diCVE-2026-919377.5Flowise before 3.1.4 fails to sanitize the overrideConfig.sessionId parameter before using it in MongoDB queries within the MongoDBMemory noCVE-2026-919387.1Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodeCVE-2026-919399.8Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without allowed_classes restriction, allowing unauthenticated att
CVE-2026-91928: Medium severity, CVSS 6.1 | Vulnix