CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2026-11-01
Apache Wicket Cross-Site Scripting (XSS) Vulnerability due to Missing Resource Bundle Escaping (CVE-2026-111089)
[Affected Scope] Apache Wicket versions 8.0.0 to 8.19.0, 9.0.0 to 9.24.0, and 10.0.0 to 10.11.0
[Impact] Unescaped resource bundle texts written into JavaScript literals and HTML attributes allow arbitrary script execution under the application's origin
[Mitigation] Immediately upgrade Apache Wicket to patched versions 8.20.0, 9.25.0, or 10.12.0 or higher