Login Request a demo
WI
Product
Wicket
by Apache · last CVE Aug 31, 2026
33
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities33In the news0Timeline
Severity mix
Critical 3High 7Medium 18Low 0
Severity
All severities33Critical3High7Medium18Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Wicket to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2024-36522
9.8
2%
Jul 12
The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation
Affected: 8.0.0 before 8.16.0; 9.0.0 before 9.18.0; 10.0.0; 10.0.0
CVE-2026-40010
9.1
0%
May 6
Apache Wicket: possible session fixation using AuthenticatedWebSession
Affected: 8.0.0 through 8.17.0; 9.0.0 through 9.22.0; 10.0.0 before 10.9.0
CVE-2016-6793
9.1
8%
Jul 17
The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a denial of service (infinite loop) and write to, move, and…
Affected: 1.5.0 before 1.5.17; 6.0.0 before 6.25.0
Showing 3