First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-91999

MediumCVSS 6.1/10Last modified Sep 30, 2026

Description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS.

This issue affects Apache Sling XSS: before 2.4.12.

Users are recommended to upgrade to version 2.4.12, which fixes the issue.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Sling XSS	< 2.4.12

References

Timeline

Published: Sep 23, 2026
Last modified: Sep 30, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-92007.5The Query Shortcode plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.2.1 via the shortcode CVE-2026-920007.5adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attack CVE-2026-920016.1Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS. This issue affect CVE-2026-920025.1Affected versions of MISP use Redis to throttle repeated authentication-failure log entries. The intent is to avoid excessive duplicate logs CVE-2026-920036.9Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle. Two API authentication failure b CVE-2026-920055.3Use-after-free in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3,CVE-2026-920068.8Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 15 CVE-2026-920078.8Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 15 CVE-2026-920088.8Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 15 CVE-2026-920098.8Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 15 CVE-2026-92018.8IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute arbitrary code due to a cryptographic weakness in the CVE-2026-920108.8Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 15

CVE-2026-91999: Medium severity, CVSS 6.1 | Vulnix