| CVE-2026-111089 |
Apache Wicket reads texts from the application's resource bundles — a localized label, a css class name — and writes…
|
7.6
High
|
Nov 1, 2026 |
| CVE-2026-95863 |
Improper neutralization of input during web page generation in Apache Wicket
|
7.6
High
|
Nov 1, 2026 |
| CVE-2026-87718 |
Apache Wicket 10.10.0, 10.11.0 and 9.24.0 do not set the Content-Security-Policy headers on a page whose render…
|
2.3
Low
|
Nov 1, 2026 |
| CVE-2026-84231 |
Improper neutralization of input during web page generation in Apache Wicket
|
7.4
High
|
Nov 1, 2026 |
| CVE-2026-84177 |
Incorrect behavior order in Apache Wicket: a file path is validated before the framework appends the attributes that…
|
6.3
Medium
|
Nov 1, 2026 |
| CVE-2026-84172 |
Files accessible to external parties in Apache Wicket
|
6.3
Medium
|
Nov 1, 2026 |
| CVE-2026-84170 |
Allocation of resources without limits or throttling in Apache Wicket
|
8.3
High
|
Nov 1, 2026 |
| CVE-2026-83594 |
Memory allocation with an excessive size value in Apache Wicket
|
8.3
High
|
Nov 1, 2026 |
| CVE-2026-83559 |
Improper encoding or escaping of output in Apache Wicket
|
7.4
High
|
Nov 1, 2026 |
| CVE-2026-83539 |
Improper neutralization of input during web page generation in Apache Wicket
|
7.4
High
|
Nov 1, 2026 |
| CVE-2026-82956 |
Improper neutralization of input during web page generation in Apache Wicket
|
7.6
High
|
Nov 1, 2026 |
| CVE-2026-82898 |
Incorrect order of security checks in Apache Wicket
|
2.1
Low
|
Nov 1, 2026 |
| CVE-2026-82840 |
Session fixation in Apache Wicket
|
7.2
High
|
Nov 1, 2026 |
| CVE-2026-82705 |
Missing authorization in Apache Wicket
|
6.3
Medium
|
Nov 1, 2026 |
| CVE-2026-82704 |
Missing authorization in Apache Wicket
|
6.9
Medium
|
Nov 1, 2026 |
| CVE-2026-82559 |
Insufficient session expiration in Apache Wicket
|
2.3
Low
|
Nov 1, 2026 |
| CVE-2026-82558 |
Missing authorization in Apache Wicket
|
2.3
Low
|
Nov 1, 2026 |
| CVE-2026-82557 |
Missing authorization in Apache Wicket
|
6.9
Medium
|
Nov 1, 2026 |
| CVE-2026-82115 |
Missing authorization in Apache Wicket
|
6.3
Medium
|
Nov 1, 2026 |
| CVE-2026-76986 |
Improper neutralization of input during web page generation in Apache Wicket
|
Not rated
|
Aug 31, 2026 |
| CVE-2026-76985 |
Improper neutralization of input during web page generation in Apache Wicket
|
5.1
Medium
|
Aug 31, 2026 |
| CVE-2026-76983 |
Improper neutralization of input during web page generation in Apache Wicket
|
5.1
Medium
|
Aug 31, 2026 |
| CVE-2026-76984 |
Improper neutralization of input during web page generation in Apache Wicket
|
5.1
Medium
|
Aug 31, 2026 |
| CVE-2026-76982 |
Improper neutralization of input during web page generation in Apache Wicket
|
5.1
Medium
|
Aug 31, 2026 |
| CVE-2026-75802 |
AjaxEditableChoiceLabel in wicket-extensions, when constructed with a non-null IChoiceRenderer, writes the display value…
|
5.1
Medium
|
Aug 31, 2026 |