WI
Product
Wicket
33
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 7Medium 18Low 0
Watch
Add Wicket to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-6806 | 8.8 | Oct 3 | Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin requests Affected: 6.20.0; 6.21.0; 6.22.0; 6.23.0; 6.24.0; 7.0.0; +5 more |
| CVE-2026-71257 | 7.5 | Aug 31 | Apache Wicket: Configured file upload limits are not enforced when the multipart request has already been parsed Affected: 8.0.0 before 8.19.0; 9.0.0 before 9.24.0; 10.0.0 before 10.11.0 |
| CVE-2026-43646 | 7.5 | May 6 | Apache Wicket: crafted URLs can bypass PackageResourceGuard Affected: 8.0.0 through 8.17.0; 9.0.0 through 9.22.0; 10.0.0 before 10.9.0 |
| CVE-2021-23937 | 7.5 | May 25 | A DNS proxy and possible amplification attack vulnerability in WebClientInfo of Apache Wicket allows an attacker to trigger arbitrary DNS lookups from the server when the… Affected: 6.0.0 through 6.2.0; 7.0.0 through 7.17.0; 8.0.0 through 8.11.0; 9.0.0 through 9.2.0 |
| CVE-2020-11976 | 7.5 | Aug 11 | By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates Affected: before 7.17.0; 8.0.0 before 8.9.0; 9.0.0; 9.0.0; 9.0.0; 9.0.0; +1 more |
| CVE-2014-3526 | 7.5 | Oct 30 | Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive information via vectors involving identifiers for storing… Affected: 1.5.0 before 1.5.12; 6.0.0; 6.0.0; 6.0.0; 6.0.0; 6.1.0; +20 more |
| CVE-2014-7808 | 7.5 | Sep 15 | Apache Wicket before 1.5.13, 6.x before 6.19.0, and 7.x before 7.0.0-M5 make it easier for attackers to defeat a cryptographic protection mechanism and predict encrypted URLs by… Affected: 1.5.0 before 1.5.13; 6.0.0 before 6.19.0; 7.0.0; 7.0.0; 7.0.0; 7.0.0; +1 more |
Showing 7