Apache Sling Security Bundle vulnerabilities

Latest Apache Sling Security Bundle CVEs

Newest publication first

1. CVE-2026-94243 Apache Sling Security Bundle: RefererFilter accepts weaker-than-origin evidence

   Published 2026-09-23

   High·CVSS 7.3

   A vulnerability in Apache Sling Security Bundle: the ReferrerFilter accepts weaker-than-orgin evidence. This issue affects Apache Sling Security Bundle: before 1.3.2. Users are recommended to upgrade to version 1.3.2, which fixes the issue.

2. CVE-2026-94251 Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource

   Published 2026-09-23

   Medium·CVSS 6.5

   A vulnerability in Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource This issue affects Apache Sling Security Bundle: before 1.3.12. Users are recommended to upgrade to version 1.3.12, which fixes the issue.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.