CVE-2026-103864None▾ SunlitImproper output neutralization for logs in Apache Sling Engine. This issue affects Apache Sling Engine: before 3.0.4. Users are recommended to upgrade to version 3.0.4, which fixes the issue.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Improper output neutralization for logs in Apache Sling Engine.
This issue affects Apache Sling Engine: before 3.0.4.
Users are recommended to upgrade to version 3.0.4, which fixes the issue.
apache_sling_engine < 3.0.4Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-103866NoneApache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling
CVE-2026-103863NoneApache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper paths
CVE-2024-0690Medium· 5.0Ansible-core: possible information leak in tasks that ignore ansible_no_log configuration
CVE-2026-111211Medium· 5.3Potential log injection via unescaped geometry form values
CVE-2026-118994NoneCallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name
CVE-2026-119423Medium· 5.3OPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login Username