CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Apache Wicket JavaScriptUtils Escape Bypass Remote Script Execution Vulnerability (CVE-2026-83559)
[Affected Scope] Apache Wicket versions 8.0.0 to 8.19.0, 9.0.0 to 9.24.0, 10.0.0 to 10.11.0, and unsupported 7.x or older versions
[Impact] Attackers can bypass the escaping logic by combining backslashes and quotes, leading to arbitrary JavaScript execution (XSS) within the victim's browser session
[Mitigation] Immediately upgrade to the patched versions: 8.20.0, 9.25.0, or 10.12.0 depending on your current release branch
Apache Wicket AjaxNewWindowNotifyingBehavior Cross-Site Scripting (XSS) Vulnerability (CVE-2026-82956)
[Affected Scope] Apache Wicket versions 8.0.0 to 8.19.0, 9.0.0 to 9.24.0, and 10.0.0 to 10.11.0, specifically when AjaxNewWindowNotifyingBehavior is explicitly used
[Impact] Attackers can manipulate the browser's window.name to execute arbitrary malicious JavaScript within the victim's session context, leading to session hijacking and data theft
[Mitigation] Immediately upgrade to patched Apache Wicket versions 8.20.0, 9.25.0, or 10.12.0
Apache Wicket Cross-Site Scripting (XSS) Vulnerability due to Missing Resource Bundle Escaping (CVE-2026-111089)
[Affected Scope] Apache Wicket versions 8.0.0 to 8.19.0, 9.0.0 to 9.24.0, and 10.0.0 to 10.11.0
[Impact] Unescaped resource bundle texts written into JavaScript literals and HTML attributes allow arbitrary script execution under the application's origin
[Mitigation] Immediately upgrade Apache Wicket to patched versions 8.20.0, 9.25.0, or 10.12.0 or higher
Apache Wicket WebSocket Resource Missing Authorization Vulnerability (CVE-2026-82115) Analysis & Mitigation Guide
[Affected Scope] Apache Wicket versions 8.0.0 to 8.19.0, 9.0.0 to 9.24.0, 10.0.0 to 10.11.0, and unsupported 7.x releases
[Impact] Unauthorized attackers can bypass security strategies to directly access WebSocket resources and execute arbitrary business logic via custom payloads
[Mitigation] Immediately upgrade Apache Wicket to version 8.20.0, 9.25.0, or 10.12.0 or higher