Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.wicket:wicket-core

31 known vulnerabilities (8 high, 15 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release
11.0.0 (Nov 2, 2026): no advisory affects it
Newest unaffected release
11.0.0 (Nov 2, 2026), the latest release
Advisories
31 · 8 high, 15 medium, 2 low
Releases
166 since 1.5.0 (Sep 2, 2011)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-111089
    Affects 8.0.0 to 8.19.0 (8.20.0 is outside it); 9.0.0 to 9.24.0 (9.25.0 is outside it); 10.0.0 to 10.11.0 (10.12.0 is outside it)
  • CVE-2026-95863
    Affects 8.0.0 to 8.19.0 (8.20.0 is outside it); 9.0.0 to 9.24.0 (9.25.0 is outside it); 10.0.0 to 10.11.0 (10.12.0 is outside it)
  • CVE-2026-87718
    Affects 9.24.0 (9.25.0 is outside it); 10.10.0 to 10.11.0 (10.12.0 is outside it)
  • CVE-2026-84231
    Affects 8.0.0 to 8.19.0 (8.20.0 is outside it)
  • CVE-2026-84177
    Affects 8.0.0 to 8.19.0 (8.20.0 is outside it); 9.0.0 to 9.24.0 (9.25.0 is outside it); 10.0.0 to 10.11.0 (10.12.0 is outside it)
  • CVE-2026-84172
    Affects 8.0.0 to 8.19.0 (8.20.0 is outside it); 9.0.0 to 9.24.0 (9.25.0 is outside it); 10.0.0 to 10.11.0 (10.12.0 is outside it)
  • CVE-2026-84170
    Affects 9.14.0 to 9.24.0 (9.25.0 is outside it); 10.0.0 to 10.9.1 (10.10.0 is outside it)
  • CVE-2026-83594
    Affects 9.14.0 to 9.24.0 (9.25.0 is outside it); 10.0.0 to 10.11.0 (10.12.0 is outside it)
  • CVE-2026-83559
    Affects 8.0.0 to 8.19.0 (8.20.0 is outside it); 9.0.0 to 9.24.0 (9.25.0 is outside it); 10.0.0 to 10.11.0 (10.12.0 is outside it)
  • CVE-2026-82956
    Affects 8.0.0 to 8.19.0 (8.20.0 is outside it); 9.0.0 to 9.24.0 (9.25.0 is outside it); 10.0.0 to 10.11.0 (10.12.0 is outside it)
  • CVE-2026-82898
    Affects 9.1.0 to 9.24.0 (9.25.0 is outside it); 10.0.0 to 10.11.0 (10.12.0 is outside it)
  • CVE-2026-82705
    Affects 8.0.0 to 8.19.0 (8.20.0 is outside it); 9.0.0 to 9.24.0 (9.25.0 is outside it); 10.0.0 to 10.11.0 (10.12.0 is outside it)
Show all 31 advisoriesShow fewer advisories
  • CVE-2026-82704
    Affects 8.0.0 to 8.19.0 (8.20.0 is outside it); 9.0.0 to 9.24.0 (9.25.0 is outside it); 10.0.0 to 10.11.0 (10.12.0 is outside it)
  • CVE-2026-82557
    Affects 10.3.0 to 10.11.0 (10.12.0 is outside it)
  • CVE-2026-76986
    Affects 8.0.0 to 8.18.0 (8.19.0 is outside it); 9.0.0 to 9.23.0 (9.24.0 is outside it); 10.0.0 to 10.10.0 (10.11.0 is outside it)
  • CVE-2026-76983
    Affects 8.0.0 to 8.18.0 (8.19.0 is outside it); 9.0.0 to 9.23.0 (9.24.0 is outside it); 10.0.0 to 10.10.0 (10.11.0 is outside it)
  • CVE-2026-76984
    Affects 8.0.0 to 8.18.0 (8.19.0 is outside it); 9.0.0 to 9.23.0 (9.24.0 is outside it); 10.0.0 to 10.10.0 (10.11.0 is outside it)
  • CVE-2026-76982
    Affects 8.0.0 to 8.18.0 (8.19.0 is outside it); 9.0.0 to 9.23.0 (9.24.0 is outside it); 10.0.0 to 10.10.0 (10.11.0 is outside it)
  • CVE-2026-71378
    Affects 9.1.0 to 9.23.0 (9.24.0 is outside it); 10.0.0 to 10.10.0 (10.11.0 is outside it)
  • CVE-2026-71257
    Affects 8.0.0 to 8.18.0 (8.19.0 is outside it); 9.0.0 to 9.23.0 (9.24.0 is outside it); 10.0.0 to 10.10.0 (10.11.0 is outside it)
  • CVE-2026-70449
    Affects 8.0.0 to 8.18.0 (8.19.0 is outside it); 9.0.0 to 9.23.0 (9.24.0 is outside it); 10.0.0 to 10.10.0 (10.11.0 is outside it)
  • CVE-2026-66391
    Affects 9.0.0 to 9.23.0 (9.24.0 is outside it); 10.0.0 to 10.9.0 (10.9.1 is outside it)
  • CVE-2026-66390
    Affects 9.0.0 to 9.23.0 (9.24.0 is outside it); 10.0.0 to 10.9.0 (10.9.1 is outside it)
  • CVE-2026-43975
    Affects 8.0.0-M1 to 8.17.0 (8.18.0 is outside it); 9.0.0-M1 to 9.22.0 (9.23.0 is outside it); 10.0.0-M1 to 10.8.0 (10.9.0 is outside it)
  • CVE-2024-53299
    Affects 7.0.0 to 8.16.0 (8.17.0 is outside it); 9.0.0-M1 to 9.18.0 (9.19.0 is outside it); 10.0.0 to 10.2.0 (10.3.0 is outside it)
  • CVE-2021-23937
    Affects 1.5-RC1 to 7.17.0 (7.18.0 is outside it); 8.0.0 to 8.11.0 (8.12.0 is outside it); 9.0.0 to 9.2.0 (9.3.0 is outside it)
  • CVE-2020-11976
    Affects 1.5-RC1 to 7.16.0 (7.17.0 is outside it); 8.0.0 to 8.8.0 (8.9.0 is outside it); 9.0.0-M1 to 9.0.0-M5 (9.0.0 is outside it)
  • CVE-2014-3526
    Affects 1.5-RC1 to 1.5.11 (1.5.12 is outside it); 6.0.0 to 6.16.0 (6.17.0 is outside it); 7.0.0-M1 to 7.0.0-M2 (7.0.0-M3 is outside it)
  • CVE-2016-6806
    Affects 6.20.0 to 6.24.0 (6.25.0 is outside it); 7.0.0 to 7.4.0 (7.5.0 is outside it); 8.0.0-M1 (8.0.0-M2 is outside it)
  • CVE-2014-0043
    Affects 1.5-RC1 to 1.5.10 (1.5.11 is outside it); 6.0.0-beta1 to 6.13.0 (6.14.0 is outside it)
  • CVE-2014-7808
    Affects 1.5-RC1 to 1.5.12 (1.5.13 is outside it); 6.0.0-beta1 to 6.18.0 (6.19.0 is outside it); 7.0.0-M1 to 7.0.0-M4 (7.0.0-M5 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 31

  • Apache Wicket: XSS via a resource bundle text written unescaped into generated JavaScript and markup

    Affected: from 8.0.0, through 8.19.0; from 9.0.0, through 9.24.0; from 10.0.0, through 10.11.0.

    Fixed in 10.12.0 (released Oct 28, 2026, 4 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 11.0.0, is not affected.

  • Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markup

    Affected: from 8.0.0, through 8.19.0; from 9.0.0, through 9.24.0; from 10.0.0, through 10.11.0.

    Fixed in 10.12.0 (released Oct 28, 2026, 4 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 11.0.0, is not affected.

  • Apache Wicket: CSP headers silently omitted for pages served through nested request handler delegates

    Affected: from 10.10.0, through 10.11.0.

    Fixed in 10.12.0 (released Oct 28, 2026, 4 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 11.0.0, is not affected.

  • Apache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor tag

    Affected: from 8.0.0, through 8.19.0.

    Fixed in 8.20.0 (released Oct 26, 2026, 6 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 11.0.0, is not affected.

  • CVE-2026-84177Medium 6.3

    Apache Wicket: A component's markup is served as a package resource when its class name contains an underscore

    Affected: from 8.0.0, through 8.19.0; from 9.0.0, through 9.24.0; from 10.0.0, through 10.11.0.

    Fixed in 10.12.0 (released Oct 28, 2026, 4 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 11.0.0, is not affected.

  • CVE-2026-84172Medium 6.3

    Apache Wicket: Component markup is served as a package resource when wicket-core has its own class loader

    Affected: from 8.0.0, through 8.19.0; from 9.0.0, through 9.24.0; from 10.0.0, through 10.11.0.

    Fixed in 10.12.0 (released Oct 28, 2026, 4 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 11.0.0, is not affected.

  • Apache Wicket: Configured upload limits are not enforced by the standalone file upload resource

    Affected: from 9.14.0, through 9.24.0; from 10.0.0, through 10.9.1.

    Fixed in 10.10.0 (released Jul 22, 2026, 102 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 11.0.0, is not affected.

  • Apache Wicket: FileUploadToResourceField accepts a client-asserted upload result and allocates the size it names

    Affected: from 9.14.0, through 9.24.0; from 10.0.0, through 10.11.0.

    Fixed in 10.12.0 (released Oct 28, 2026, 4 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 11.0.0, is not affected.

  • Apache Wicket: JavaScriptUtils#escapeQuotes does not escape the backslash, so its output can leave its string literal

    Affected: from 8.0.0, through 8.19.0; from 9.0.0, through 9.24.0; from 10.0.0, through 10.11.0.

    Fixed in 10.12.0 (released Oct 28, 2026, 4 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 11.0.0, is not affected.

  • Apache Wicket: XSS in AjaxNewWindowNotifyingBehavior via the client-supplied window name

    Affected: from 8.0.0, through 8.19.0; from 9.0.0, through 9.24.0; from 10.0.0, through 10.11.0.

    Fixed in 10.12.0 (released Oct 28, 2026, 4 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 11.0.0, is not affected.

  • Apache Wicket: A cross-origin listener invocation stopped by a login wall is replayed after the user signs in

    Affected: from 9.1.0, through 9.24.0; from 10.0.0, through 10.11.0.

    Fixed in 10.12.0 (released Oct 28, 2026, 4 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 11.0.0, is not affected.

  • CVE-2026-82705Medium 6.3

    Apache Wicket: The configured authorization strategy is not applied to an IResource embedded in a component

    Affected: from 8.0.0, through 8.19.0; from 9.0.0, through 9.24.0; from 10.0.0, through 10.11.0.

    Fixed in 10.12.0 (released Oct 28, 2026, 4 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 11.0.0, is not affected.

  • CVE-2026-82704Medium 6.9

    Apache Wicket: A listener is invoked on a page instance the request itself created and never configured

    Affected: from 8.0.0, through 8.19.0; from 9.0.0, through 9.24.0; from 10.0.0, through 10.11.0.

    Fixed in 10.12.0 (released Oct 28, 2026, 4 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 11.0.0, is not affected.

  • CVE-2026-82557Medium 6.9

    Apache Wicket: A disabled or invisible form submitting component is still invoked on a plain form submission

    Affected: from 10.3.0, through 10.11.0.

    Fixed in 10.12.0 (released Oct 28, 2026, 4 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 11.0.0, is not affected.

  • CVE-2026-76986Medium 6.1

    Apache Wicket: XSS in AbstractSingleSelectChoice via getNullValidDisplayValue

    Affected: from 8.0.0, through 8.18.0; from 9.0.0, through 9.23.0; from 10.0.0, through 10.10.0.

    Fixed in 10.11.0 (released Aug 24, 2026, 7 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 11.0.0, is not affected.

Show all 31 advisoriesShow fewer advisories
  • CVE-2026-76983Medium 5.1

    Apache Wicket: XSS in AutoLabelTextResolver via FormComponent.setLabel

    Affected: from 8.0.0, through 8.18.0; from 9.0.0, through 9.23.0; from 10.0.0, through 10.10.0.

    Fixed in 10.11.0 (released Aug 24, 2026, 7 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 11.0.0, is not affected.

  • CVE-2026-76984Medium 5.1

    Apache Wicket: XSS in MetaDataHeaderItem via addTagAttribute

    Affected: from 8.0.0, through 8.18.0; from 9.0.0, through 9.23.0; from 10.0.0, through 10.10.0.

    Fixed in 10.11.0 (released Aug 24, 2026, 7 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 11.0.0, is not affected.

  • CVE-2026-76982Medium 5.1

    Apache Wicket: XSS in Button via its model object

    Affected: from 8.0.0, through 8.18.0; from 9.0.0, through 9.23.0; from 10.0.0, through 10.10.0.

    Fixed in 10.11.0 (released Aug 24, 2026, 7 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 11.0.0, is not affected.

  • CVE-2026-71378Medium 4.6

    Apache Wicket: Cross-Site Request Forgery (CSRF) protection bypass in ResourceIsolationRequestCycleListener

    Affected: from 9.1.0, through 9.23.0; from 10.0.0, through 10.10.0.

    Fixed in 10.11.0 (released Aug 24, 2026, 7 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 11.0.0, is not affected.

  • Apache Wicket: Configured file upload limits are not enforced when the multipart request has already been parsed

    Affected: from 8.0.0, through 8.18.0; from 9.0.0, through 9.23.0; from 10.0.0, through 10.10.0.

    Fixed in 10.11.0 (released Aug 24, 2026, 7 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 11.0.0, is not affected.

  • CVE-2026-70449Medium 5.3

    Apache Wicket: Path traversal in resource style/variation/locale

    Affected: from 8.0.0, through 8.18.0; from 9.0.0, through 9.23.0; from 10.0.0, through 10.10.0.

    Fixed in 10.11.0 (released Aug 24, 2026, 7 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 11.0.0, is not affected.

  • CVE-2026-66391Medium 6.5

    Apache Wicket: leaked and missing CSP headers

    Affected: from 9.0.0, through 9.23.0; from 10.0.0, through 10.9.0.

    Fixed in 10.9.1 (released May 16, 2026, 72 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 11.0.0, is not affected.

  • CVE-2026-66390Medium 6.1

    Apache Wicket: crafted Link URL strings can break out of the JavaScript sequence

    Affected: from 9.0.0, through 9.23.0; from 10.0.0, through 10.9.0.

    Fixed in 10.9.1 (released May 16, 2026, 72 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 11.0.0, is not affected.

  • CVE-2026-43975Medium 6.5

    Apache Wicket: Possible malicious path traversal in FolderUploadsFileManager

    Affected: from 8.0.0-M1, through 8.17.0; from 9.0.0-M1, through 9.22.0; from 10.0.0-M1, fixed in 10.9.0.

    Fixed in 10.9.0 (released Apr 30, 2026, 6 days before disclosure).

    The latest release, 11.0.0, is not affected.

  • CVE-2024-53299Medium 6.5

    Apache Wicket: An attacker can intentionally trigger a memory leak

    Affected: from 7.0.0, fixed in 8.17.0; from 10.0.0, fixed in 10.3.0; from 9.0.0-M1, fixed in 9.19.0.

    Fixed in 8.17.0 (released Jan 27, 2025, 4 days after disclosure), 9.19.0 (released Dec 21, 2024, 33 days before disclosure) and 10.3.0 (released Dec 13, 2024, 41 days before disclosure).

    The latest release, 11.0.0, is not affected.

  • DNS proxy and possible amplification attack

    Affected: from 9.0.0, fixed in 9.3.0; from 8.0.0, fixed in 8.12.0; fixed in 7.18.0.

    Fixed in 7.18.0 (released Apr 2, 2021, 53 days before disclosure), 8.12.0 (released Mar 30, 2021, 56 days before disclosure) and 9.3.0 (released Mar 25, 2021, 61 days before disclosure).

    The latest release, 11.0.0, is not affected.

  • By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates.

    Affected: fixed in 7.17.0; from 8.0.0, fixed in 8.9.0; from 9.0.0-M1, fixed in 9.0.0; from 9.0.0-M2, fixed in 9.0.0; from 9.0.0-M3, fixed in 9.0.0; from 9.0.0-M4, fixed in 9.0.0; from 9.0.0-M5, fixed in 9.0.0.

    Fixed in 7.17.0 (released Jul 16, 2020, 26 days before disclosure), 8.9.0 (released Jul 11, 2020, 31 days before disclosure) and 9.0.0 (released Jul 8, 2020, 34 days before disclosure).

    The latest release, 11.0.0, is not affected.

  • Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive information via…

    Affected: fixed in 1.5.12; from 6.0, fixed in 6.17.0; from 7.0.0-M1, fixed in 7.0.0-M3.

    Fixed in 1.5.12 (released Sep 4, 2014, 1152 days before disclosure), 6.17.0 (released Aug 29, 2014, 1158 days before disclosure) and 7.0.0-M3 (released Aug 29, 2014, 1158 days before disclosure).

    The latest release, 11.0.0, is not affected.

  • Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin…

    Affected: from 6.20.0, fixed in 6.25.0; from 7.0.0, fixed in 7.5.0; from 8.0.0-M1, fixed in 8.0.0-M2.

    Fixed in 6.25.0 (released Oct 19, 2016, 348 days before disclosure), 7.5.0 (released Oct 19, 2016, 348 days before disclosure) and 8.0.0-M2 (released Oct 19, 2016, 348 days before disclosure).

    The latest release, 11.0.0, is not affected.

  • In Apache Wicket 1.5.10 or 6.13.0, by issuing requests to special urls handled by Wicket, it is possible to check for the existence of…

    Affected: from 1.5-RC1, fixed in 1.5.11; from 6.0.0-beta1, fixed in 6.14.0.

    Fixed in 1.5.11 (released Jan 20, 2014, 1351 days before disclosure) and 6.14.0 (released Feb 14, 2014, 1326 days before disclosure).

    The latest release, 11.0.0, is not affected.

  • Apache Wicket before 1.5.13, 6.x before 6.19.0, and 7.x before 7.0.0-M5 make it easier for attackers to defeat a cryptographic protection…

    Affected: fixed in 1.5.13; from 6.0.0-beta1, fixed in 6.19.0; from 7.0.0-M1, fixed in 7.0.0-M5.

    Fixed in 1.5.13 (released Feb 9, 2015, 949 days before disclosure), 6.19.0 (released Jan 26, 2015, 963 days before disclosure) and 7.0.0-M5 (released Jan 26, 2015, 963 days before disclosure).

    The latest release, 11.0.0, is not affected.