CVE-2026-123765 medium vulnerability summary
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. xssAPI.getStyleToken() accepts markup in unquoted urls. This issue affects Apache Sling XSS: before...
CVE-2026-123765 is a Medium severity vulnerability notice that security teams should triage for exposure in their own environments.
What to review
The affected area appears to involve Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. xssAPI.getStyleToken() accepts markup. Administrators should compare this notice against their asset inventory, dependency list, and externally exposed services.
Recommended action
Confirm whether the affected product or library is present, review vendor guidance, prioritize patching based on internet exposure and severity, and monitor logs for suspicious behavior tied to the affected component.
This brief is based on information from Tenable Newest CVEs . Please refer to the original source for the complete advisory and vendor-specific guidance.
Related Posts
CVE-2026-126642 medium vulnerability summary
An incorrect authorization flaw was found in AWX, the automation controller component of Red Hat Ansible Automation Platform. The API access classes for JobTemplate and WorkflowJobTemplate do not check the caller's Crede...
CVE-2026-90908 critical vulnerability summary
A vulnerability in the GenericAdminAuthenticator component of Azul Payara Server and Azul Payara Micro allows a remote, unauthenticated attacker to bypass JMX/RMI administrative access restrictions by spoofing the client...
CVE-2026-76173 high vulnerability summary
Blind SQL injection vulnerability in the public endpoint `public/webhook/receiver.php` of the WhatsApp module for Dolibarr 1.9. The phone number value derived from the `data.key.remoteJid` parameter, received via a JSON...