Apache wicket

This hub aggregates every CVE we track for Apache wicket, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Apache wicket.

• CVE-2026-76986Apache Wicket: XSS in AbstractSingleSelectChoice via getNullValidDisplayValue6.1Aug 31, 2026
• CVE-2026-76985Apache Wicket: XSS in Palette via getAdditionalAttributes5.4Aug 31, 2026
• CVE-2026-76983Apache Wicket: XSS in AutoLabelTextResolver via FormComponent.setLabel5.4Aug 31, 2026
• CVE-2026-76984Apache Wicket: XSS in MetaDataHeaderItem via addTagAttribute5.4Aug 31, 2026
• CVE-2026-76982Apache Wicket: XSS in Button via its model object5.4Aug 31, 2026
• CVE-2026-75802Apache Wicket: XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and defaultNullLabel5.4Aug 31, 2026
• CVE-2026-71378Apache Wicket: Cross-Site Request Forgery (CSRF) protection bypass in ResourceIsolationRequestCycleListener4.6Aug 31, 2026
• CVE-2026-71257Apache Wicket: Configured file upload limits are not enforced when the multipart request has already been parsed7.5Aug 31, 2026
• CVE-2026-70449Apache Wicket: Path traversal in resource style/variation/locale5.3Aug 31, 2026
• CVE-2026-66391Apache Wicket: leaked and missing CSP headers6.5Jul 27, 2026
• CVE-2026-66390Apache Wicket: crafted Link URL strings can break out of the JavaScript sequence6.1Jul 27, 2026
• CVE-2026-40010Apache Wicket: possible session fixation using AuthenticatedWebSession9.1May 6, 2026
• CVE-2026-42509Apache Wicket: crafted strings can break out of the JavaScript sequence6.1May 6, 2026
• CVE-2026-43646Apache Wicket: crafted URLs can bypass PackageResourceGuard7.5May 6, 2026
• CVE-2026-43975Apache Wicket: Possible malicious path traversal in FolderUploadsFileManager6.5May 6, 2026