What’s Vulnerable › Products
Apache Software Foundation Apache Wicket vulnerabilities
33 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 16 published in the last 12 months.
Check whether your Apache Software Foundation Apache Wicket version is affected
Latest Apache Software Foundation Apache Wicket vulnerabilities
- CVE-2026-76986 — Apache Wicket: XSS in AbstractSingleSelectChoice via getNullValidDisplayValue (CVSS 6.1)
- CVE-2026-76985 — Apache Wicket: XSS in Palette via getAdditionalAttributes (CVSS 5.4)
- CVE-2026-76984 — Apache Wicket: XSS in MetaDataHeaderItem via addTagAttribute (CVSS 5.4)
- CVE-2026-76983 — Apache Wicket: XSS in AutoLabelTextResolver via FormComponent.setLabel (CVSS 5.4)
- CVE-2026-76982 — Apache Wicket: XSS in Button via its model object (CVSS 5.4)
- CVE-2026-75802 — Apache Wicket: XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and defaultNullLabel (CVSS 5.4)
- CVE-2026-71378 — Apache Wicket: Cross-Site Request Forgery (CSRF) protection bypass in ResourceIsolationRequestCycleListener (CVSS 4.6)
- CVE-2026-71257 — Apache Wicket: Configured file upload limits are not enforced when the multipart request has already been parsed (CVSS 7.5)
- CVE-2026-70449 — Apache Wicket: Path traversal in resource style/variation/locale (CVSS 5.3)
- CVE-2026-66391 — Apache Wicket: leaked and missing CSP headers (CVSS 6.5)
- CVE-2026-66390 — Apache Wicket: crafted Link URL strings can break out of the JavaScript sequence (CVSS 6.1)
- CVE-2026-43975 — Apache Wicket: Possible malicious path traversal in FolderUploadsFileManager (CVSS 6.5)
- CVE-2026-43646 — Apache Wicket: crafted URLs can bypass PackageResourceGuard (CVSS 7.5)
- CVE-2026-42509 — Apache Wicket: crafted strings can break out of the JavaScript sequence (CVSS 6.1)
- CVE-2026-40010 — Apache Wicket: possible session fixation using AuthenticatedWebSession (CVSS 9.1)
- CVE-2024-53299 — Apache Wicket: An attacker can intentionally trigger a memory leak (CVSS 6.5)
- CVE-2024-36522 — Apache Wicket: Remote code execution via XSLT injection (CVSS 9.8)
- CVE-2024-27439 — Apache Wicket: Possible bypass of CSRF protection (CVSS 6.5)
- CVE-2021-23937 — DNS proxy and possible amplification attack (CVSS 7.5)
- CVE-2020-11976 — (CVSS 7.5)
- CVE-2012-5636 — (CVSS 6.1)
- CVE-2014-3526 — (CVSS 7.5)
- CVE-2016-6806 — (CVSS 8.8)
- CVE-2014-0043 — (CVSS 5.3)
- CVE-2014-7808 — (CVSS 7.5)