Apache Software Foundation Apache Wicket vulnerabilities and fixes
Exploited and high-severity Apache Software Foundation Apache Wicket vulnerabilities tracked by VulnFeed, with CVSS and EPSS scores, affected versions and fixes.
- 7.4CVE-2026-84231Apache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor tagVerify fixApache Software Foundation Apache Wicket
2 min read - 7.6CVE-2026-82956Apache Wicket: XSS in AjaxNewWindowNotifyingBehavior via the client-supplied window nameVerify fixApache Software Foundation Apache Wicket
2 min read - 7.4CVE-2026-83539Apache Wicket: XSS in SmartLinkLabel and SmartLinkMultiLineLabel via a javascript: URL in the model dataVerify fixApache Software Foundation Apache Wicket
2 min read - 7.4CVE-2026-83559Apache Wicket: JavaScriptUtils#escapeQuotes does not escape the backslash, so its output can leave its string literalVerify fixApache Software Foundation Apache Wicket
2 min read - 8.3CVE-2026-83594Apache Wicket: FileUploadToResourceField accepts a client-asserted upload result and allocates the size it namesVerify fixApache Software Foundation Apache Wicket
2 min read - 8.3CVE-2026-84170Apache Wicket: Configured upload limits are not enforced by the standalone file upload resourceVerify fixApache Software Foundation Apache Wicket
2 min read - 7.6CVE-2026-111089Apache Wicket: XSS via a resource bundle text written unescaped into generated JavaScript and markupVerify fixApache Software Foundation Apache Wicket
2 min read - 7.6CVE-2026-95863Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markupVerify fixApache Software Foundation Apache Wicket
2 min read - 7.2CVE-2026-82840Apache Wicket: The session id is renewed only on the first sign in, not on re-authenticationVerify fixApache Software Foundation Apache Wicket
2 min read