Apache Wicket vulnerabilities

• apache wicket Apache Wicket: XSS in AbstractSingleSelectChoice via getNullValidDisplayValue CVE-2026-76986 6.1 MediumAugust 31, 2026
• apache wicket Apache Wicket: XSS in Palette via getAdditionalAttributes CVE-2026-76985 5.1 MediumAugust 31, 2026
• apache wicket Apache Wicket: XSS in AutoLabelTextResolver via FormComponent.setLabel CVE-2026-76983 5.1 MediumAugust 31, 2026
• apache wicket Apache Wicket: XSS in MetaDataHeaderItem via addTagAttribute CVE-2026-76984 5.1 MediumAugust 31, 2026
• apache wicket Apache Wicket: XSS in Button via its model object CVE-2026-76982 5.1 MediumAugust 31, 2026
• apache wicket Apache Wicket: XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and defaultNullLabel CVE-2026-75802 5.1 MediumAugust 31, 2026
• apache wicket Apache Wicket: Cross-Site Request Forgery (CSRF) protection bypass in ResourceIsolationRequestCycleListener CVE-2026-71378 4.6 MediumAugust 31, 2026
• apache wicket Apache Wicket: Configured file upload limits are not enforced when the multipart request has already been parsed CVE-2026-71257 7.5 HighAugust 31, 2026
• apache wicket Apache Wicket: Path traversal in resource style/variation/locale CVE-2026-70449 5.3 MediumAugust 31, 2026
• apache wicket Apache Wicket: leaked and missing CSP headers CVE-2026-66391 6.5 MediumJuly 27, 2026
• apache wicket Apache Wicket: crafted Link URL strings can break out of the JavaScript sequence CVE-2026-66390 6.1 MediumJuly 27, 2026
• apache wicket Apache Wicket: possible session fixation using AuthenticatedWebSession CVE-2026-40010 Fix available 9.1 CriticalMay 6, 2026
• apache wicket Apache Wicket: crafted strings can break out of the JavaScript sequence CVE-2026-42509 Fix available 6.1 MediumMay 6, 2026
• apache wicket Apache Wicket: crafted URLs can bypass PackageResourceGuard CVE-2026-43646 Fix available 7.5 HighMay 6, 2026
• apache wicket Apache Wicket: Possible malicious path traversal in FolderUploadsFileManager CVE-2026-43975 Fix available 6.5 MediumMay 6, 2026
• apache wicket Apache Wicket: An attacker can intentionally trigger a memory leak CVE-2024-53299 Fix available 6.5 MediumJanuary 23, 2025
• apache wicket Apache Wicket: Remote code execution via XSLT injection CVE-2024-36522 Fix available 9.8 CriticalJuly 12, 2024
• apache wicket Apache Wicket: Possible bypass of CSRF protection CVE-2024-27439 Fix available 6.5 MediumMarch 19, 2024
• apache wicket DNS proxy and possible amplification attack CVE-2021-23937 Fix available 7.5 HighMay 25, 2021
• apache wicket, fortress +1 more Exposure of Sensitive Information to an Unauthorized Actor in Apache Wicket CVE-2020-11976 Fix available 7.5 HighAugust 11, 2020
• apache wicket Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.22, 1.5.x before 1.5... CVE-2012-5636 6.1 MediumOctober 30, 2017
• apache wicket Apache Wicket Sensitive Data Exposure CVE-2014-3526 Fix available 7.5 HighOctober 30, 2017
• apache wicket Apache Wicket vulnerable to CSRF attacks CVE-2016-6806 Fix available 8.8 HighOctober 2, 2017
• apache wicket Apache Wicket allows attackers to check for third-party libraries CVE-2014-0043 Public exploitFix available 5.3 MediumOctober 2, 2017
• apache wicket Apache Wicket insecure defaults CVE-2014-7808 Fix available 7.5 HighSeptember 15, 2017
• apache wicket The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote... CVE-2016-6793 9.1 CriticalJuly 14, 2017
• apache wicket Multiple cross-site scripting (XSS) vulnerabilities in the (1) RadioGroup and (2)... CVE-2015-7520 6.1 MediumApril 12, 2016
• apache wicket Cross-site scripting (XSS) vulnerability in the getWindowOpenJavaScript function in org.apache... CVE-2015-5347 Public exploit 6.1 MediumApril 12, 2016
• apache wicket Unspecified vulnerability in Apache Wicket 1.4.x before 1.4.23, 1.5.x before 1.5.11, and 6.x... CVE-2013-2055 5.0 MediumFebruary 10, 2014
• apache wicket Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.21 and 1.5.x before 1... CVE-2012-3373 4.3 MediumSeptember 19, 2012
• apache wicket Directory traversal vulnerability in Apache Wicket 1.4.x before 1.4.20 and 1.5.x before 1.5.5... CVE-2012-1089 5.0 MediumMarch 23, 2012
• apache wicket Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.20 allows remote... CVE-2012-0047 4.3 MediumMarch 23, 2012
• apache wicket Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.18, when... CVE-2011-2712 2.6 LowAugust 29, 2011