Apache Software Foundation Apache Wicket

• CVE-2026-111089 High 7.6 Apache Wicket: XSS via a resource bundle text written unescaped into generated JavaScript and markup 0.3%
• CVE-2026-95863 High 7.6 Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markup 0.3%
• CVE-2026-87718 Low 2.3 Apache Wicket: CSP headers silently omitted for pages served through nested request handler delegates 0.3%
• CVE-2026-84231 High 7.4 Apache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor tag 0.3%
• CVE-2026-84177 Medium 6.3 Apache Wicket: A component's markup is served as a package resource when its class name contains an underscore 0.3%
• CVE-2026-84172 Medium 6.3 Apache Wicket: Component markup is served as a package resource when wicket-core has its own class loader 0.3%
• CVE-2026-84170 High 8.3 Apache Wicket: Configured upload limits are not enforced by the standalone file upload resource 0.3%
• CVE-2026-83594 High 8.3 Apache Wicket: FileUploadToResourceField accepts a client-asserted upload result and allocates the size it names 0.3%
• CVE-2026-83559 High 7.4 Apache Wicket: JavaScriptUtils#escapeQuotes does not escape the backslash, so its output can leave its string literal 0.3%
• CVE-2026-83539 High 7.4 Apache Wicket: XSS in SmartLinkLabel and SmartLinkMultiLineLabel via a javascript: URL in the model data 0.3%
• CVE-2026-82956 High 7.6 Apache Wicket: XSS in AjaxNewWindowNotifyingBehavior via the client-supplied window name 0.3%
• CVE-2026-82898 Low 2.1 Apache Wicket: A cross-origin listener invocation stopped by a login wall is replayed after the user signs in 0.3%
• CVE-2026-82840 High 7.2 Apache Wicket: The session id is renewed only on the first sign in, not on re-authentication 0.3%
• CVE-2026-82705 Medium 6.3 Apache Wicket: The configured authorization strategy is not applied to an IResource embedded in a component 0.3%
• CVE-2026-82704 Medium 6.9 Apache Wicket: A listener is invoked on a page instance the request itself created and never configured 0.3%
• CVE-2026-82559 Low 2.3 Apache Wicket: WebSocket messages are processed against an HTTP session snapshot that survives invalidation 0.3%
• CVE-2026-82558 Low 2.3 Apache Wicket: WebSocketBehavior delivers client messages to a component the client may not invoke 0.3%
• CVE-2026-82557 Medium 6.9 Apache Wicket: A disabled or invisible form submitting component is still invoked on a plain form submission 0.3%
• CVE-2026-82115 Medium 6.3 Apache Wicket: The configured authorization strategy is not applied to a shared WebSocketResource 0.3%
• CVE-2026-76986 Medium 6.1 Apache Wicket: XSS in AbstractSingleSelectChoice via getNullValidDisplayValue 0.6%
• CVE-2026-76985 Medium 5.1 Apache Wicket: XSS in Palette via getAdditionalAttributes 0.5%
• CVE-2026-76983 Medium 5.1 Apache Wicket: XSS in AutoLabelTextResolver via FormComponent.setLabel 0.5%
• CVE-2026-76984 Medium 5.1 Apache Wicket: XSS in MetaDataHeaderItem via addTagAttribute 0.5%
• CVE-2026-76982 Medium 5.1 Apache Wicket: XSS in Button via its model object 0.5%
• CVE-2026-75802 Medium 5.1 Apache Wicket: XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and defaultNullLabel 0.5%
• CVE-2026-71378 Medium 4.6 Apache Wicket: Cross-Site Request Forgery (CSRF) protection bypass in ResourceIsolationRequestCycleListener 0.3%
• CVE-2026-71257 High 7.5 Apache Wicket: Configured file upload limits are not enforced when the multipart request has already been parsed 0.7%
• CVE-2026-70449 Medium 5.3 Apache Wicket: Path traversal in resource style/variation/locale 0.9%
• CVE-2026-66391 Medium 6.5 Apache Wicket: leaked and missing CSP headers 0.6%
• CVE-2026-66390 Medium 6.1 Apache Wicket: crafted Link URL strings can break out of the JavaScript sequence 0.6%
• CVE-2026-40010 Critical 9.1 Apache Wicket: possible session fixation using AuthenticatedWebSession 0.4%
• CVE-2026-42509 Medium 6.1 Apache Wicket: crafted strings can break out of the JavaScript sequence 0.4%
• CVE-2026-43646 High 7.5 Apache Wicket: crafted URLs can bypass PackageResourceGuard 0.4%
• CVE-2026-43975 Medium 6.5 Apache Wicket: Possible malicious path traversal in FolderUploadsFileManager 0.7%
• CVE-2024-53299 Medium 6.5 Apache Wicket: An attacker can intentionally trigger a memory leak 1.5%
• CVE-2024-36522 Critical 9.8 Apache Wicket: Remote code execution via XSLT injection 2.1%
• CVE-2024-27439 Medium 6.5 Apache Wicket: Possible bypass of CSRF protection 0.7%
• CVE-2021-23937 Unrated DNS proxy and possible amplification attack 4.3%