CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2026-11-01
Apache Wicket SmartLinkLabel Cross-Site Scripting (XSS) Vulnerability (CVE-2026-83539)
[Affected Scope] Apache Wicket versions 8.0.0 to 8.19.0, 9.0.0 to 9.24.0, and 10.0.0 to 10.11.0 utilizing SmartLinkLabel or SmartLinkMultiLineLabel components
[Impact] Attackers can inject malicious URL schemes (e.g., javascript:) that bypass standard markup escaping, leading to arbitrary script execution in the victim's browser session upon clicking the link
[Mitigation] Upgrade Apache Wicket to version 8.20.0, 9.25.0, or 10.12.0 or higher, and ensure a robust Content-Security-Policy (CSP) is enforced