| CVE-2026-111089 |
Apache Wicket: XSS via a resource bundle text written unescaped into generated JavaScript and markup
|
7.6
High
|
Nov 1, 2026 |
| CVE-2026-95863 |
Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markup
|
7.6
High
|
Nov 1, 2026 |
| CVE-2026-87718 |
Apache Wicket: CSP headers silently omitted for pages served through nested request handler delegates
|
2.3
Low
|
Nov 1, 2026 |
| CVE-2026-84231 |
Apache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor tag
|
7.4
High
|
Nov 1, 2026 |
| CVE-2026-84177 |
Apache Wicket: A component's markup is served as a package resource when its class name contains an underscore
|
6.3
Medium
|
Nov 1, 2026 |
| CVE-2026-84172 |
Apache Wicket: Component markup is served as a package resource when wicket-core has its own class loader
|
6.3
Medium
|
Nov 1, 2026 |
| CVE-2026-84170 |
Apache Wicket: Configured upload limits are not enforced by the standalone file upload resource
|
8.3
High
|
Nov 1, 2026 |
| CVE-2026-83594 |
Apache Wicket: FileUploadToResourceField accepts a client-asserted upload result and allocates the size it names
|
8.3
High
|
Nov 1, 2026 |
| CVE-2026-83559 |
Apache Wicket: JavaScriptUtils#escapeQuotes does not escape the backslash, so its output can leave its string literal
|
7.4
High
|
Nov 1, 2026 |
| CVE-2026-83539 |
Apache Wicket: XSS in SmartLinkLabel and SmartLinkMultiLineLabel via a javascript: URL in the model data
|
7.4
High
|
Nov 1, 2026 |
| CVE-2026-82956 |
Apache Wicket: XSS in AjaxNewWindowNotifyingBehavior via the client-supplied window name
|
7.6
High
|
Nov 1, 2026 |
| CVE-2026-82898 |
Apache Wicket: A cross-origin listener invocation stopped by a login wall is replayed after the user signs in
|
2.1
Low
|
Nov 1, 2026 |
| CVE-2026-82840 |
Apache Wicket: The session id is renewed only on the first sign in, not on re-authentication
|
7.2
High
|
Nov 1, 2026 |
| CVE-2026-82705 |
Apache Wicket: The configured authorization strategy is not applied to an IResource embedded in a component
|
6.3
Medium
|
Nov 1, 2026 |
| CVE-2026-82704 |
Apache Wicket: A listener is invoked on a page instance the request itself created and never configured
|
6.9
Medium
|
Nov 1, 2026 |
| CVE-2026-82559 |
Apache Wicket: WebSocket messages are processed against an HTTP session snapshot that survives invalidation
|
2.3
Low
|
Nov 1, 2026 |
| CVE-2026-82558 |
Apache Wicket: WebSocketBehavior delivers client messages to a component the client may not invoke
|
2.3
Low
|
Nov 1, 2026 |
| CVE-2026-82557 |
Apache Wicket: A disabled or invisible form submitting component is still invoked on a plain form submission
|
6.9
Medium
|
Nov 1, 2026 |
| CVE-2026-82115 |
Apache Wicket: The configured authorization strategy is not applied to a shared WebSocketResource
|
6.3
Medium
|
Nov 1, 2026 |
| CVE-2026-76986 |
Improper neutralization of input during web page generation in Apache Wicket
|
Not rated
|
Aug 31, 2026 |
| CVE-2026-76985 |
Improper neutralization of input during web page generation in Apache Wicket
|
5.1
Medium
|
Aug 31, 2026 |
| CVE-2026-76983 |
Improper neutralization of input during web page generation in Apache Wicket
|
5.1
Medium
|
Aug 31, 2026 |
| CVE-2026-76984 |
Improper neutralization of input during web page generation in Apache Wicket
|
5.1
Medium
|
Aug 31, 2026 |
| CVE-2026-76982 |
Improper neutralization of input during web page generation in Apache Wicket
|
5.1
Medium
|
Aug 31, 2026 |
| CVE-2026-75802 |
AjaxEditableChoiceLabel in wicket-extensions, when constructed with a non-null IChoiceRenderer, writes the display value…
|
5.1
Medium
|
Aug 31, 2026 |