org.apache.wicket:wicket-core vulnerabilities
CVEs whose affected-version data names the org.apache.wicket:wicket-core package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
14 CVEsRSS
CVE-2026-84177Medium· 6.3Apache Wicket: A component's markup is served as a package resource when its class name contains an underscore
Incorrect behavior order in Apache Wicket: a file path is validated before the framework appends the attributes that complete it. org.apache.wicket.request.resource.PackageResource asks the configured package resource guard about a path…
CVE-2026-87718Low· 2.3Apache Wicket: CSP headers silently omitted for pages served through nested request handler delegates
Apache Wicket 10.10.0, 10.11.0 and 9.24.0 do not set the Content-Security-Policy headers on a page whose render request handler is wrapped in more than one IRequestHandlerDelegate. The framework unwraps only a single delegate level when …
CVE-2026-111089High· 7.6Apache Wicket: XSS via a resource bundle text written unescaped into generated JavaScript and markup
Apache Wicket reads texts from the application's resource bundles — a localized label, a css class name — and writes some of them into the JavaScript and the markup it generates for a component. Those texts are placed inside single-quote…
CVE-2026-95863High· 7.6Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markup
Improper neutralization of input during web page generation in Apache Wicket. Apache Wicket generates JavaScript that refers to the elements it renders, and writes into that JavaScript two values it derives itself: a component's markup …
CVE-2026-83594High· 8.3Apache Wicket: FileUploadToResourceField accepts a client-asserted upload result and allocates the size it names
Memory allocation with an excessive size value in Apache Wicket. org.apache.wicket.markup.html.form.upload.resource.FileUploadToResourceField uploads files to a separately mounted resource rather than through a form, and is told the out…
CVE-2026-84231High· 7.4Apache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor tag
Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.link.ExternalLink builds a JavaScript click handler and writes it into the tag's onclick attribute whenever the markup tag the c…
CVE-2026-84170High· 8.3Apache Wicket: Configured upload limits are not enforced by the standalone file upload resource
Allocation of resources without limits or throttling in Apache Wicket. org.apache.wicket.markup.html.form.upload.resource.AbstractFileUploadResource is the server side of the form-less upload offered by FileUploadToResourceField, which …
CVE-2026-84172Medium· 6.3Apache Wicket: Component markup is served as a package resource when wicket-core has its own class loader
Files accessible to external parties in Apache Wicket. org.apache.wicket.markup.html.PackageResourceGuard decides whether a file on the classpath may be streamed to a client as a package resource. HTML is on the default allow list, so t…
CVE-2026-83559High· 7.4Apache Wicket: JavaScriptUtils#escapeQuotes does not escape the backslash, so its output can leave its string literal
Improper encoding or escaping of output in Apache Wicket. org.apache.wicket.core.util.string.JavaScriptUtils#escapeQuotes() replaces each single quote in its input with a backslash and a single quote, and each double quote with a backsl…
CVE-2026-82705Medium· 6.3Apache Wicket: The configured authorization strategy is not applied to an IResource embedded in a component
Missing authorization in Apache Wicket. org.apache.wicket.authorization.IAuthorizationStrategy declares isResourceAuthorized(), and that method has a single enforcement point in the framework: org.apache.wicket.request.handler.resource.…
CVE-2026-82557Medium· 6.9Apache Wicket: A disabled or invisible form submitting component is still invoked on a plain form submission
Missing authorization in Apache Wicket. org.apache.wicket.markup.html.form.Form resolves the component that submitted a form from the request parameters in Form#onRequest() and passes the result directly to Form#onFormSubmitted(IFormSub…
CVE-2026-82956High· 7.6Apache Wicket: XSS in AjaxNewWindowNotifyingBehavior via the client-supplied window name
Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.ajax.AjaxNewWindowNotifyingBehavior notices that a page instance has been opened in a second browser window or tab. It asks the browser for …
CVE-2026-82898Low· 2.1Apache Wicket: A cross-origin listener invocation stopped by a login wall is replayed after the user signs in
Incorrect order of security checks in Apache Wicket. org.apache.wicket.protocol.http.ResourceIsolationRequestCycleListener obtains the page a request targets before it consults its resource isolation policies, because those policies are…
CVE-2026-82704Medium· 6.9Apache Wicket: A listener is invoked on a page instance the request itself created and never configured
Missing authorization in Apache Wicket. org.apache.wicket.core.request.handler.ListenerRequestHandler invokes an IRequestListener only when org.apache.wicket.Component#canCallListener() allows it, and that method is isEnabledInHierarchy…