CVE-2026-92001
Last modified
CVE-2026-92001 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.. EPSS estimates a 0.19% chance of exploitation in the next 30 days.
Description
Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Sling XSS | < 2.4.12 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-92001?
How severe is CVE-2026-92001?
How do I fix CVE-2026-92001?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-91996lamp-cloud through 5.10.0 whitelists the path pattern /*/ann…7.5
- CVE-2026-91997evolution-api through 2.3.7 contains an incorrect array comp…5.3
- CVE-2026-91998Casdoor through 4.4.0 contains an authorization bypass vulne…9.9
- CVE-2026-91999Improper neutralization of input during web page generation …6.1
- CVE-2026-9200The Query Shortcode plugin for WordPress is vulnerable to Lo…7.5
- CVE-2026-92000adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib dec…7.5
- CVE-2026-92002Affected versions of MISP use Redis to throttle repeated aut…5.1
- CVE-2026-92003Affected versions of MISP do not consistently apply the exis…6.9
- CVE-2026-92005Use-after-free in the Audio/Video: Web Codecs component. Thi…5.3
- CVE-2026-92006Privilege escalation due to incorrect boundary conditions in…8.8
- CVE-2026-92007Privilege escalation due to incorrect boundary conditions in…8.8
- CVE-2026-92008Privilege escalation due to incorrect boundary conditions in…8.8
Are you affected by CVE-2026-92001?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST