Login Request a demo
AW
Product
Apache Wicket
by Apache Software Foundation · last CVE Aug 31, 2026
15
CVEs
0
On KEV
9.1
Max CVSS
0
New 30D
Vulnerabilities15In the news0Timeline
Severity mix
Critical 1High 2Medium 12Low 0
Severity
All severities15Critical1High2Medium12Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Apache Wicket to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-40010
9.1
0%
May 6
Apache Wicket: possible session fixation using AuthenticatedWebSession
Affected: 10.0.0 through 10.8.0; 8.0.0 through 8.17.0; 9.0.0 through 9.22.0
CVE-2026-71257
7.5
1%
Aug 31
Apache Wicket: Configured file upload limits are not enforced when the multipart request has already been parsed
Affected: 8.0.0 through 8.18.0; 9.0.0 through 9.23.0; 10.0.0 through 10.10.0
CVE-2026-43646
7.5
0%
May 6
Apache Wicket: crafted URLs can bypass PackageResourceGuard
Affected: 8.0.0 through 8.17.0; 9.0.0 through 9.22.0; 10.0.0 through 10.8.0
CVE-2026-66391
6.5
1%
Jul 27
Apache Wicket: leaked and missing CSP headers
Affected: 9.0.0 through 9.23.0; 10.0.0 through 10.9.0
CVE-2026-43975
6.5
1%
May 6
Apache Wicket: Possible malicious path traversal in FolderUploadsFileManager
Affected: 10.0.0 through 10.8.0; 9.0.0 through 9.22.0; 8.0.0 through 8.17
CVE-2026-76986
6.1
1%
Aug 31
Apache Wicket: XSS in AbstractSingleSelectChoice via getNullValidDisplayValue
Affected: 8.0.0 through 8.18.0; 9.0.0 through 9.23.0; 10.0.0 through 10.10.0
CVE-2026-66390
6.1
1%
Jul 27
Apache Wicket: crafted Link URL strings can break out of the JavaScript sequence
Affected: 9.0.0 through 9.23.0; 10.0.0 through 10.9.0
CVE-2026-42509
6.1
0%
May 6
Apache Wicket: crafted strings can break out of the JavaScript sequence
Affected: 8.0.0 through 8.17.0; 9.0.0 through 9.22.0; 10.0.0 through 10.8.0
CVE-2026-76985
5.4
1%
Aug 31
Apache Wicket: XSS in Palette via getAdditionalAttributes
Affected: 8.0.0 through 8.18.0; 9.0.0 through 9.23.0; 10.0.0 through 10.10.0
CVE-2026-76983
5.4
1%
Aug 31
Apache Wicket: XSS in AutoLabelTextResolver via FormComponent.setLabel
Affected: 8.0.0 through 8.18.0; 9.0.0 through 9.23.0; 10.0.0 through 10.10.0
CVE-2026-76984
5.4
1%
Aug 31
Apache Wicket: XSS in MetaDataHeaderItem via addTagAttribute
Affected: 8.0.0 through 8.18.0; 9.0.0 through 9.23.0; 10.0.0 through 10.10.0
CVE-2026-76982
5.4
1%
Aug 31
Apache Wicket: XSS in Button via its model object
Affected: 8.0.0 through 8.18.0; 9.0.0 through 9.23.0; 10.0.0 through 10.10.0
CVE-2026-75802
5.4
1%
Aug 31
Apache Wicket: XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and defaultNullLabel
Affected: 8.0.0 through 8.18.0; 9.0.0 through 9.23.0; 10.0.0 through 10.10.0
CVE-2026-70449
5.3
1%
Aug 31
Apache Wicket: Path traversal in resource style/variation/locale
Affected: 8.0.0 through 8.18.0; 9.0.0 through 9.23.0; 10.0.0 through 10.10.0
CVE-2026-71378
4.6
0%
Aug 31
Apache Wicket: Cross-Site Request Forgery (CSRF) protection bypass in ResourceIsolationRequestCycleListener
Affected: 9.1.0 through 9.23.0; 10.0.0 through 10.10.0
Showing 15