UNKNOWNCVSS not yet scoredVulnerability
CVE-2026-123765
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. xssAPI.getStyleToken() accepts markup in unquoted urls. This issue affects Apache Sling XSS: before 2.4.14. Users are recommended to upgrade to version 2.4.14, which fixes the issue.
Properties
- Last source
- FIRST EPSS
- Nvd fetched at
- 2026-11-14T00:40:25.638091+00:00
- Epss score
- 0.00213
- Cve id
- CVE-2026-123765
- First seen by Signal
- 2026-11-12T11:54:41+00:00
- Name
- CVE-2026-123765
- Retrieved at
- 2026-11-14T00:51:03+00:00
- Published at
- 2026-11-12T10:17:28.523
- Last modified
- 2026-11-12T17:06:26.857
- Epss percentile
- 0.11687
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph