Skip to content
Apache Software Foundation Wicket vulnerabilities
-
apache software foundation wicket
Apache Wicket: XSS via a resource bundle text written unescaped into generated JavaScript and markup
CVE-2026-111089
7.6 High
-
apache software foundation wicket
Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markup
CVE-2026-95863
7.6 High
-
apache software foundation wicket
Apache Wicket: CSP headers silently omitted for pages served through nested request handler delegates
CVE-2026-87718
2.3 Low
-
apache software foundation wicket
Apache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor tag
CVE-2026-84231
7.4 High
-
apache software foundation wicket
Apache Wicket: A component's markup is served as a package resource when its class name contains an underscore
CVE-2026-84177
6.3 Medium
-
apache software foundation wicket
Apache Wicket: Component markup is served as a package resource when wicket-core has its own class loader
CVE-2026-84172
6.3 Medium
-
apache software foundation wicket
Apache Wicket: Configured upload limits are not enforced by the standalone file upload resource
CVE-2026-84170
8.3 High
-
apache software foundation wicket
Apache Wicket: FileUploadToResourceField accepts a client-asserted upload result and allocates the size it names
CVE-2026-83594
8.3 High
-
apache software foundation wicket
Apache Wicket: JavaScriptUtils#escapeQuotes does not escape the backslash, so its output can leave its string literal
CVE-2026-83559
7.4 High
-
apache software foundation wicket
Apache Wicket: XSS in SmartLinkLabel and SmartLinkMultiLineLabel via a javascript: URL in the model data
CVE-2026-83539
7.4 High
-
apache software foundation wicket
Apache Wicket: XSS in AjaxNewWindowNotifyingBehavior via the client-supplied window name
CVE-2026-82956
7.6 High
-
apache software foundation wicket
Apache Wicket: A cross-origin listener invocation stopped by a login wall is replayed after the user signs in
CVE-2026-82898
2.1 Low
-
apache software foundation wicket
Apache Wicket: The session id is renewed only on the first sign in, not on re-authentication
CVE-2026-82840
7.2 High
-
apache software foundation wicket
Apache Wicket: The configured authorization strategy is not applied to an IResource embedded in a component
CVE-2026-82705
6.3 Medium
-
apache software foundation wicket
Apache Wicket: A listener is invoked on a page instance the request itself created and never configured
CVE-2026-82704
6.9 Medium
-
apache software foundation wicket
Apache Wicket: WebSocket messages are processed against an HTTP session snapshot that survives invalidation
CVE-2026-82559
2.3 Low
-
apache software foundation wicket
Apache Wicket: WebSocketBehavior delivers client messages to a component the client may not invoke
CVE-2026-82558
2.3 Low
-
apache software foundation wicket
Apache Wicket: A disabled or invisible form submitting component is still invoked on a plain form submission
CVE-2026-82557
6.9 Medium
-
apache software foundation wicket
Apache Wicket: The configured authorization strategy is not applied to a shared WebSocketResource
CVE-2026-82115
6.3 Medium
-
apache wicket
Apache Wicket: XSS in AbstractSingleSelectChoice via getNullValidDisplayValue
CVE-2026-76986
6.1 Medium
-
apache wicket
Apache Wicket: XSS in Palette via getAdditionalAttributes
CVE-2026-76985
5.1 Medium
-
apache wicket
Apache Wicket: XSS in AutoLabelTextResolver via FormComponent.setLabel
CVE-2026-76983
5.1 Medium
-
apache wicket
Apache Wicket: XSS in MetaDataHeaderItem via addTagAttribute
CVE-2026-76984
5.1 Medium
-
apache wicket
Apache Wicket: XSS in Button via its model object
CVE-2026-76982
5.1 Medium
-
apache wicket
Apache Wicket: XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and defaultNullLabel
CVE-2026-75802
5.1 Medium
-
apache wicket
Apache Wicket: Cross-Site Request Forgery (CSRF) protection bypass in ResourceIsolationRequestCycleListener
CVE-2026-71378
4.6 Medium
-
apache wicket
Apache Wicket: Configured file upload limits are not enforced when the multipart request has already been parsed
CVE-2026-71257
7.5 High
-
apache wicket
Apache Wicket: Path traversal in resource style/variation/locale
CVE-2026-70449
5.3 Medium
-
apache wicket
Apache Wicket: leaked and missing CSP headers
CVE-2026-66391
6.5 Medium
-
apache wicket
Apache Wicket: crafted Link URL strings can break out of the JavaScript sequence
CVE-2026-66390
6.1 Medium
-
apache wicket
Apache Wicket: possible session fixation using AuthenticatedWebSession
CVE-2026-40010
Fix available
9.1 Critical
-
apache wicket
Apache Wicket: crafted strings can break out of the JavaScript sequence
CVE-2026-42509
Fix available
6.1 Medium
-
apache wicket
Apache Wicket: crafted URLs can bypass PackageResourceGuard
CVE-2026-43646
Fix available
7.5 High
-
apache wicket
Apache Wicket: Possible malicious path traversal in FolderUploadsFileManager
CVE-2026-43975
Fix available
6.5 Medium
-
apache wicket
Apache Wicket: An attacker can intentionally trigger a memory leak
CVE-2024-53299
Fix available
6.5 Medium
-
apache wicket
Apache Wicket: Remote code execution via XSLT injection
CVE-2024-36522
Fix available
9.8 Critical
-
apache wicket
Apache Wicket: Possible bypass of CSRF protection
CVE-2024-27439
Fix available
6.5 Medium
-
apache wicket
DNS proxy and possible amplification attack
CVE-2021-23937
Fix available
7.5 High
-
apache wicket, fortress +1 more
Exposure of Sensitive Information to an Unauthorized Actor in Apache Wicket
CVE-2020-11976
Fix available
7.5 High
-
apache wicket
Apache Wicket vulnerable to CSRF attacks
CVE-2016-6806
Fix available
8.8 High
-
apache wicket
Apache Wicket allows attackers to check for third-party libraries
CVE-2014-0043
Public exploitFix available
5.3 Medium