Apache Wicket (Apache Software Foundation) - vulnerabilities (CVEs)
21 CVEs, 0 in the last 30 days, 15 known versions, newest CVE from 2026-08-31. Vendor: Apache Software Foundation.
CVEs of Apache Wicket
- CVE-2026-76986 - CVSS 6.1 (medium), 2026-08-31: Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.AbstractSingleSelectChoice, the base class of…
- CVE-2026-76985 - CVSS 5.4 (medium), 2026-08-31: Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.extensions.markup.html.form.palette.component.AbstractOptions,…
- CVE-2026-76983 - CVSS 5.4 (medium), 2026-08-31: Improper neutralization of input during web page generation in Apache Wicket. The <wicket:label> tag is provided by…
- CVE-2026-76984 - CVSS 5.4 (medium), 2026-08-31: Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.head.MetaDataHeaderItem generates <meta> and <link>…
- CVE-2026-76982 - CVSS 5.4 (medium), 2026-08-31: Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.Button clears the escape-model-strings flag…
- CVE-2026-75802 - CVSS 5.4 (medium), 2026-08-31: AjaxEditableChoiceLabel in wicket-extensions, when constructed with a non-null IChoiceRenderer, writes the display value obtained from that renderer into the…
- CVE-2026-71378 - CVSS 4.6 (medium), 2026-08-31: ResourceIsolationRequestCycleListener protects a Wicket application against cross-site request forgery by rejecting requests that a resource isolation policy…
- CVE-2026-71257 - CVSS 7.5 (high), 2026-08-31: Apache Wicket enforces the upload limits configured on a form or upload field while parsing a multipart request with Apache Commons FileUpload. If the request…
- CVE-2026-70449 - CVSS 5.3 (medium), 2026-08-31: Improper validation of resource URL attributes in Apache Wicket allows an unauthenticated remote attacker to read files from the web application, including…
- CVE-2026-66391 - CVSS 6.5 (medium), 2026-07-27: Use of Insufficiently Random Values, Protection Mechanism Failure vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0,…
- CVE-2026-66390 - CVSS 6.1 (medium), 2026-07-27: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket. This issue affects Apache Wicket: from…
- CVE-2026-43975 - CVSS 6.5 (medium), 2026-05-06: FolderUploadsFileManager in Apache Wicket does not validate or sanitize the uploadFieldId parameter or the clientFileName before constructing file paths,…
- CVE-2026-43646 - CVSS 7.5 (high), 2026-05-06: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Wicket. This issue affects Apache Wicket: from 8.0.0 through 8.17.0, from…
- CVE-2026-40010 - CVSS 9.1 (critical), 2026-05-06: Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a session fixation attack in Apache Wicket.…
- CVE-2026-42509 - CVSS 6.1 (medium), 2026-05-06: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket. This issue affects Apache Wicket: from…
- CVE-2024-53299 - CVSS 6.5 (medium), 2025-01-23: The request handling in the core in Apache Wicket 7.0.0 on any platform allows an attacker to create a DOS via multiple requests to server resources. Users…
- CVE-2024-36522 - CVSS 9.8 (critical), 2024-07-12: The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source…
- CVE-2024-27439 - CVSS 6.5 (medium), 2024-03-19: An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket. This issue affects Apache Wicket: from…
- CVE-2021-23937 - CVSS 7.5 (high), 2021-05-25: A DNS proxy and possible amplification attack vulnerability in WebClientInfo of Apache Wicket allows an attacker to trigger arbitrary DNS lookups from the…
- CVE-2016-6806 - CVSS 8.8 (high), 2017-10-03: Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin requests. The…
- CVE-2014-0043 - CVSS 5.3 (medium), 2017-10-03: In Apache Wicket 1.5.10 or 6.13.0, by issuing requests to special urls handled by Wicket, it is possible to check for the existence of particular classes in…
