| CVE-2026-71378 |
ResourceIsolationRequestCycleListener protects a Wicket application against cross-site request forgery by rejecting…
|
Not rated
|
Aug 31, 2026 |
| CVE-2026-71257 |
Apache Wicket enforces the upload limits configured on a form or upload field while parsing a multipart request with…
|
Not rated
|
Aug 31, 2026 |
| CVE-2026-70449 |
Improper validation of resource URL attributes in Apache Wicket allows an unauthenticated remote attacker to read…
|
Not rated
|
Aug 31, 2026 |
| CVE-2026-66391 |
Use of Insufficiently Random Values, Protection Mechanism Failure vulnerability in Apache Wicket
|
Not rated
|
Jul 27, 2026 |
| CVE-2026-66390 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket
|
Not rated
|
Jul 27, 2026 |
| CVE-2026-40010 |
Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for…
|
Not rated
|
May 6, 2026 |
| CVE-2026-42509 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket
|
Not rated
|
May 6, 2026 |
| CVE-2026-43646 |
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Wicket
|
Not rated
|
May 6, 2026 |
| CVE-2026-43975 |
FolderUploadsFileManager in Apache Wicket does not validate or sanitize the uploadFieldId parameter or the…
|
Not rated
|
May 6, 2026 |
| CVE-2024-53299 |
The request handling in the core in Apache Wicket 7.0.0 on any platform allows an attacker to create a DOS via…
|
Not rated
|
Jan 23, 2025 |
| CVE-2024-36522 |
The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when…
|
Not rated
|
Jul 12, 2024 |
| CVE-2024-27439 |
An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket
|
Not rated
|
Mar 19, 2024 |
| CVE-2021-23937 |
A DNS proxy and possible amplification attack vulnerability in WebClientInfo of Apache Wicket allows an attacker to…
|
Not rated
|
May 25, 2021 |
| CVE-2014-0043 |
In Apache Wicket 1.5.10 or 6.13.0, by issuing requests to special urls handled by Wicket, it is possible to check for…
|
Not rated
|
Oct 2, 2017 |
| CVE-2016-6806 |
Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover…
|
Not rated
|
Oct 2, 2017 |