WI
Product
Wicket
33
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 7Medium 18Low 0
Watch
Add Wicket to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-66391 | 6.5 | Jul 27 | Apache Wicket: leaked and missing CSP headers Affected: 9.0.0 through 9.23.0; 10.0.0 before 10.10.0 |
| CVE-2026-43975 | 6.5 | May 6 | Apache Wicket: Possible malicious path traversal in FolderUploadsFileManager Affected: 8.0.0 through 8.17.0; 9.0.0 through 9.22.0; 10.0.0 before 10.9.0 |
| CVE-2024-53299 | 6.5 | Jan 23 | The request handling in the core in Apache Wicket 7.0.0 on any platform allows an attacker to create a DOS via multiple requests to server resources Affected: 7.0.0 through 7.18.0; 8.0.0 through 8.16.0; 9.0.0 before 9.19.0; 10.0.0 before 10.3.0 |
| CVE-2024-27439 | 6.5 | Mar 19 | An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket Affected: 9.1.0 before 9.17.0; 10.0.0; 10.0.0 |
| CVE-2026-76986 | 6.1 | Aug 31 | Apache Wicket: XSS in AbstractSingleSelectChoice via getNullValidDisplayValue Affected: 8.0.0 before 8.19.0; 9.0.0 before 9.24.0; 10.0.0 before 10.11.0 |
| CVE-2026-66390 | 6.1 | Jul 27 | Apache Wicket: crafted Link URL strings can break out of the JavaScript sequence Affected: 9.0.0 through 9.23.0; 10.0.0 before 10.10.0 |
| CVE-2026-42509 | 6.1 | May 6 | Apache Wicket: crafted strings can break out of the JavaScript sequence Affected: 8.0.0 through 8.17.0; 9.0.0 through 9.22.0; 10.0.0 before 10.9.0 |
| CVE-2012-5636 | 6.1 | Oct 30 | Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.22, 1.5.x before 1.5.10, and 6.x before 6.4.0 might allow remote attackers to inject arbitrary web… Affected: 1.4.0; 1.4.1; 1.4.2; 1.4.3; 1.4.4; 1.4.5; +31 more |
| CVE-2015-7520 | 6.1 | Apr 12 | Multiple cross-site scripting (XSS) vulnerabilities in the (1) RadioGroup and (2) CheckBoxMultipleChoice classes in Apache Wicket 1.5.x before 1.5.15, 6.x before 6.22.0, and 7.x… Affected: 1.5.0 before 1.5.15; 6.0.0 before 6.22.0; 7.0.0 before 7.2.0 |
| CVE-2015-5347 | 6.1 | Apr 12 | Cross-site scripting (XSS) vulnerability in the getWindowOpenJavaScript function in org.apache.wicket.extensions.ajax.markup.html.modal.ModalWindow in Apache Wicket 1.5.x before… Affected: 1.5.0 before 1.5.15; 6.0.0 before 6.22.0; 7.0 before 7.2.0 |
| CVE-2026-76985 | 5.4 | Aug 31 | Apache Wicket: XSS in Palette via getAdditionalAttributes Affected: 8.0.0 before 8.19.0; 9.0.0 before 9.24.0; 10.0.0 before 10.11.0 |
| CVE-2026-76983 | 5.4 | Aug 31 | Apache Wicket: XSS in AutoLabelTextResolver via FormComponent.setLabel Affected: 8.0.0 before 8.19.0; 9.0.0 before 9.24.0; 10.0.0 before 10.11.0 |
| CVE-2026-76984 | 5.4 | Aug 31 | Apache Wicket: XSS in MetaDataHeaderItem via addTagAttribute Affected: 8.0.0 before 8.19.0; 9.0.0 before 9.24.0; 10.0.0 before 10.11.0 |
| CVE-2026-76982 | 5.4 | Aug 31 | Apache Wicket: XSS in Button via its model object Affected: 8.0.0 before 8.19.0; 9.0.0 before 9.24.0; 10.0.0 before 10.11.0 |
| CVE-2026-75802 | 5.4 | Aug 31 | Apache Wicket: XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and defaultNullLabel Affected: 8.0.0 before 8.19.0; 9.0.0 before 9.24.0; 10.0.0 before 10.11.0 |
| CVE-2026-70449 | 5.3 | Aug 31 | Apache Wicket: Path traversal in resource style/variation/locale Affected: 8.0.0 before 8.19.0; 9.0.0 before 9.24.0; 10.0.0 before 10.11.0 |
| CVE-2014-0043 | 5.3 | Oct 3 | In Apache Wicket 1.5.10 or 6.13.0, by issuing requests to special urls handled by Wicket, it is possible to check for the existence of particular classes in the classpath and thus… Affected: 1.5.10; 6.13.0 |
| CVE-2026-71378 | 4.6 | Aug 31 | Apache Wicket: Cross-Site Request Forgery (CSRF) protection bypass in ResourceIsolationRequestCycleListener Affected: 9.1.0 before 9.24.0; 10.0.0 before 10.11.0 |
Showing 18