CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1–1 of 1 advisories (Page 1/1)
2026-11-01
Apache Wicket JavaScriptUtils Escape Bypass Remote Script Execution Vulnerability (CVE-2026-83559)
[Affected Scope] Apache Wicket versions 8.0.0 to 8.19.0, 9.0.0 to 9.24.0, 10.0.0 to 10.11.0, and unsupported 7.x or older versions
[Impact] Attackers can bypass the escaping logic by combining backslashes and quotes, leading to arbitrary JavaScript execution (XSS) within the victim's browser session
[Mitigation] Immediately upgrade to the patched versions: 8.20.0, 9.25.0, or 10.12.0 depending on your current release branch