# org.apache.wicket:wicket-core (Maven) vulnerabilities 31 known vulnerabilities (8 high, 15 medium, 2 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 11.0.0 (Nov 2, 2026): no advisory affects it - Newest unaffected release: 11.0.0 (Nov 2, 2026), the latest release - Releases: 166 since 1.5.0 (Sep 2, 2011) - Registry: https://central.sonatype.com/artifact/org.apache.wicket/wicket-core - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-111089: 8.0.0 to 8.19.0 (8.20.0 is outside it); 9.0.0 to 9.24.0 (9.25.0 is outside it); 10.0.0 to 10.11.0 (10.12.0 is outside it) - CVE-2026-95863: 8.0.0 to 8.19.0 (8.20.0 is outside it); 9.0.0 to 9.24.0 (9.25.0 is outside it); 10.0.0 to 10.11.0 (10.12.0 is outside it) - CVE-2026-87718: 9.24.0 (9.25.0 is outside it); 10.10.0 to 10.11.0 (10.12.0 is outside it) - CVE-2026-84231: 8.0.0 to 8.19.0 (8.20.0 is outside it) - CVE-2026-84177: 8.0.0 to 8.19.0 (8.20.0 is outside it); 9.0.0 to 9.24.0 (9.25.0 is outside it); 10.0.0 to 10.11.0 (10.12.0 is outside it) - CVE-2026-84172: 8.0.0 to 8.19.0 (8.20.0 is outside it); 9.0.0 to 9.24.0 (9.25.0 is outside it); 10.0.0 to 10.11.0 (10.12.0 is outside it) - CVE-2026-84170: 9.14.0 to 9.24.0 (9.25.0 is outside it); 10.0.0 to 10.9.1 (10.10.0 is outside it) - CVE-2026-83594: 9.14.0 to 9.24.0 (9.25.0 is outside it); 10.0.0 to 10.11.0 (10.12.0 is outside it) - CVE-2026-83559: 8.0.0 to 8.19.0 (8.20.0 is outside it); 9.0.0 to 9.24.0 (9.25.0 is outside it); 10.0.0 to 10.11.0 (10.12.0 is outside it) - CVE-2026-82956: 8.0.0 to 8.19.0 (8.20.0 is outside it); 9.0.0 to 9.24.0 (9.25.0 is outside it); 10.0.0 to 10.11.0 (10.12.0 is outside it) - CVE-2026-82898: 9.1.0 to 9.24.0 (9.25.0 is outside it); 10.0.0 to 10.11.0 (10.12.0 is outside it) - CVE-2026-82705: 8.0.0 to 8.19.0 (8.20.0 is outside it); 9.0.0 to 9.24.0 (9.25.0 is outside it); 10.0.0 to 10.11.0 (10.12.0 is outside it) - CVE-2026-82704: 8.0.0 to 8.19.0 (8.20.0 is outside it); 9.0.0 to 9.24.0 (9.25.0 is outside it); 10.0.0 to 10.11.0 (10.12.0 is outside it) - CVE-2026-82557: 10.3.0 to 10.11.0 (10.12.0 is outside it) - CVE-2026-76986: 8.0.0 to 8.18.0 (8.19.0 is outside it); 9.0.0 to 9.23.0 (9.24.0 is outside it); 10.0.0 to 10.10.0 (10.11.0 is outside it) - CVE-2026-76983: 8.0.0 to 8.18.0 (8.19.0 is outside it); 9.0.0 to 9.23.0 (9.24.0 is outside it); 10.0.0 to 10.10.0 (10.11.0 is outside it) - CVE-2026-76984: 8.0.0 to 8.18.0 (8.19.0 is outside it); 9.0.0 to 9.23.0 (9.24.0 is outside it); 10.0.0 to 10.10.0 (10.11.0 is outside it) - CVE-2026-76982: 8.0.0 to 8.18.0 (8.19.0 is outside it); 9.0.0 to 9.23.0 (9.24.0 is outside it); 10.0.0 to 10.10.0 (10.11.0 is outside it) - CVE-2026-71378: 9.1.0 to 9.23.0 (9.24.0 is outside it); 10.0.0 to 10.10.0 (10.11.0 is outside it) - CVE-2026-71257: 8.0.0 to 8.18.0 (8.19.0 is outside it); 9.0.0 to 9.23.0 (9.24.0 is outside it); 10.0.0 to 10.10.0 (10.11.0 is outside it) - CVE-2026-70449: 8.0.0 to 8.18.0 (8.19.0 is outside it); 9.0.0 to 9.23.0 (9.24.0 is outside it); 10.0.0 to 10.10.0 (10.11.0 is outside it) - CVE-2026-66391: 9.0.0 to 9.23.0 (9.24.0 is outside it); 10.0.0 to 10.9.0 (10.9.1 is outside it) - CVE-2026-66390: 9.0.0 to 9.23.0 (9.24.0 is outside it); 10.0.0 to 10.9.0 (10.9.1 is outside it) - CVE-2026-43975: 8.0.0-M1 to 8.17.0 (8.18.0 is outside it); 9.0.0-M1 to 9.22.0 (9.23.0 is outside it); 10.0.0-M1 to 10.8.0 (10.9.0 is outside it) - CVE-2024-53299: 7.0.0 to 8.16.0 (8.17.0 is outside it); 9.0.0-M1 to 9.18.0 (9.19.0 is outside it); 10.0.0 to 10.2.0 (10.3.0 is outside it) - CVE-2021-23937: 1.5-RC1 to 7.17.0 (7.18.0 is outside it); 8.0.0 to 8.11.0 (8.12.0 is outside it); 9.0.0 to 9.2.0 (9.3.0 is outside it) - CVE-2020-11976: 1.5-RC1 to 7.16.0 (7.17.0 is outside it); 8.0.0 to 8.8.0 (8.9.0 is outside it); 9.0.0-M1 to 9.0.0-M5 (9.0.0 is outside it) - CVE-2014-3526: 1.5-RC1 to 1.5.11 (1.5.12 is outside it); 6.0.0 to 6.16.0 (6.17.0 is outside it); 7.0.0-M1 to 7.0.0-M2 (7.0.0-M3 is outside it) - CVE-2016-6806: 6.20.0 to 6.24.0 (6.25.0 is outside it); 7.0.0 to 7.4.0 (7.5.0 is outside it); 8.0.0-M1 (8.0.0-M2 is outside it) - CVE-2014-0043: 1.5-RC1 to 1.5.10 (1.5.11 is outside it); 6.0.0-beta1 to 6.13.0 (6.14.0 is outside it) - CVE-2014-7808: 1.5-RC1 to 1.5.12 (1.5.13 is outside it); 6.0.0-beta1 to 6.18.0 (6.19.0 is outside it); 7.0.0-M1 to 7.0.0-M4 (7.0.0-M5 is outside it) ## Advisories (31) ### [CVE-2026-111089](https://cve.now/CVE-2026-111089): Apache Wicket: XSS via a resource bundle text written unescaped into generated JavaScript and markup - Severity: High 7.6 - Published: Nov 1, 2026 - Affected: from 8.0.0, through 8.19.0; from 9.0.0, through 9.24.0; from 10.0.0, through 10.11.0. - Fixed in 10.12.0 (released Oct 28, 2026, 4 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 11.0.0, is not affected. ### [CVE-2026-95863](https://cve.now/CVE-2026-95863): Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markup - Severity: High 7.6 - Published: Nov 1, 2026 - Affected: from 8.0.0, through 8.19.0; from 9.0.0, through 9.24.0; from 10.0.0, through 10.11.0. - Fixed in 10.12.0 (released Oct 28, 2026, 4 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 11.0.0, is not affected. ### [CVE-2026-87718](https://cve.now/CVE-2026-87718): Apache Wicket: CSP headers silently omitted for pages served through nested request handler delegates - Severity: Low 2.3 - Published: Nov 1, 2026 - Affected: from 10.10.0, through 10.11.0. - Fixed in 10.12.0 (released Oct 28, 2026, 4 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 11.0.0, is not affected. ### [CVE-2026-84231](https://cve.now/CVE-2026-84231): Apache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor tag - Severity: High 7.4 - Published: Nov 1, 2026 - Affected: from 8.0.0, through 8.19.0. - Fixed in 8.20.0 (released Oct 26, 2026, 6 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 11.0.0, is not affected. ### [CVE-2026-84177](https://cve.now/CVE-2026-84177): Apache Wicket: A component's markup is served as a package resource when its class name contains an underscore - Severity: Medium 6.3 - Published: Nov 1, 2026 - Affected: from 8.0.0, through 8.19.0; from 9.0.0, through 9.24.0; from 10.0.0, through 10.11.0. - Fixed in 10.12.0 (released Oct 28, 2026, 4 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 11.0.0, is not affected. ### [CVE-2026-84172](https://cve.now/CVE-2026-84172): Apache Wicket: Component markup is served as a package resource when wicket-core has its own class loader - Severity: Medium 6.3 - Published: Nov 1, 2026 - Affected: from 8.0.0, through 8.19.0; from 9.0.0, through 9.24.0; from 10.0.0, through 10.11.0. - Fixed in 10.12.0 (released Oct 28, 2026, 4 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 11.0.0, is not affected. ### [CVE-2026-84170](https://cve.now/CVE-2026-84170): Apache Wicket: Configured upload limits are not enforced by the standalone file upload resource - Severity: High 8.3 - Published: Nov 1, 2026 - Affected: from 9.14.0, through 9.24.0; from 10.0.0, through 10.9.1. - Fixed in 10.10.0 (released Jul 22, 2026, 102 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 11.0.0, is not affected. ### [CVE-2026-83594](https://cve.now/CVE-2026-83594): Apache Wicket: FileUploadToResourceField accepts a client-asserted upload result and allocates the size it names - Severity: High 8.3 - Published: Nov 1, 2026 - Affected: from 9.14.0, through 9.24.0; from 10.0.0, through 10.11.0. - Fixed in 10.12.0 (released Oct 28, 2026, 4 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 11.0.0, is not affected. ### [CVE-2026-83559](https://cve.now/CVE-2026-83559): Apache Wicket: JavaScriptUtils#escapeQuotes does not escape the backslash, so its output can leave its string literal - Severity: High 7.4 - Published: Nov 1, 2026 - Affected: from 8.0.0, through 8.19.0; from 9.0.0, through 9.24.0; from 10.0.0, through 10.11.0. - Fixed in 10.12.0 (released Oct 28, 2026, 4 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 11.0.0, is not affected. ### [CVE-2026-82956](https://cve.now/CVE-2026-82956): Apache Wicket: XSS in AjaxNewWindowNotifyingBehavior via the client-supplied window name - Severity: High 7.6 - Published: Nov 1, 2026 - Affected: from 8.0.0, through 8.19.0; from 9.0.0, through 9.24.0; from 10.0.0, through 10.11.0. - Fixed in 10.12.0 (released Oct 28, 2026, 4 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 11.0.0, is not affected. ### [CVE-2026-82898](https://cve.now/CVE-2026-82898): Apache Wicket: A cross-origin listener invocation stopped by a login wall is replayed after the user signs in - Severity: Low 2.1 - Published: Nov 1, 2026 - Affected: from 9.1.0, through 9.24.0; from 10.0.0, through 10.11.0. - Fixed in 10.12.0 (released Oct 28, 2026, 4 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 11.0.0, is not affected. ### [CVE-2026-82705](https://cve.now/CVE-2026-82705): Apache Wicket: The configured authorization strategy is not applied to an IResource embedded in a component - Severity: Medium 6.3 - Published: Nov 1, 2026 - Affected: from 8.0.0, through 8.19.0; from 9.0.0, through 9.24.0; from 10.0.0, through 10.11.0. - Fixed in 10.12.0 (released Oct 28, 2026, 4 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 11.0.0, is not affected. ### [CVE-2026-82704](https://cve.now/CVE-2026-82704): Apache Wicket: A listener is invoked on a page instance the request itself created and never configured - Severity: Medium 6.9 - Published: Nov 1, 2026 - Affected: from 8.0.0, through 8.19.0; from 9.0.0, through 9.24.0; from 10.0.0, through 10.11.0. - Fixed in 10.12.0 (released Oct 28, 2026, 4 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 11.0.0, is not affected. ### [CVE-2026-82557](https://cve.now/CVE-2026-82557): Apache Wicket: A disabled or invisible form submitting component is still invoked on a plain form submission - Severity: Medium 6.9 - Published: Nov 1, 2026 - Affected: from 10.3.0, through 10.11.0. - Fixed in 10.12.0 (released Oct 28, 2026, 4 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 11.0.0, is not affected. ### [CVE-2026-76986](https://cve.now/CVE-2026-76986): Apache Wicket: XSS in AbstractSingleSelectChoice via getNullValidDisplayValue - Severity: Medium 6.1 - Published: Aug 31, 2026 - Affected: from 8.0.0, through 8.18.0; from 9.0.0, through 9.23.0; from 10.0.0, through 10.10.0. - Fixed in 10.11.0 (released Aug 24, 2026, 7 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 11.0.0, is not affected. ### [CVE-2026-76983](https://cve.now/CVE-2026-76983): Apache Wicket: XSS in AutoLabelTextResolver via FormComponent.setLabel - Severity: Medium 5.1 - Published: Aug 31, 2026 - Affected: from 8.0.0, through 8.18.0; from 9.0.0, through 9.23.0; from 10.0.0, through 10.10.0. - Fixed in 10.11.0 (released Aug 24, 2026, 7 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 11.0.0, is not affected. ### [CVE-2026-76984](https://cve.now/CVE-2026-76984): Apache Wicket: XSS in MetaDataHeaderItem via addTagAttribute - Severity: Medium 5.1 - Published: Aug 31, 2026 - Affected: from 8.0.0, through 8.18.0; from 9.0.0, through 9.23.0; from 10.0.0, through 10.10.0. - Fixed in 10.11.0 (released Aug 24, 2026, 7 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 11.0.0, is not affected. ### [CVE-2026-76982](https://cve.now/CVE-2026-76982): Apache Wicket: XSS in Button via its model object - Severity: Medium 5.1 - Published: Aug 31, 2026 - Affected: from 8.0.0, through 8.18.0; from 9.0.0, through 9.23.0; from 10.0.0, through 10.10.0. - Fixed in 10.11.0 (released Aug 24, 2026, 7 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 11.0.0, is not affected. ### [CVE-2026-71378](https://cve.now/CVE-2026-71378): Apache Wicket: Cross-Site Request Forgery (CSRF) protection bypass in ResourceIsolationRequestCycleListener - Severity: Medium 4.6 - Published: Aug 31, 2026 - Affected: from 9.1.0, through 9.23.0; from 10.0.0, through 10.10.0. - Fixed in 10.11.0 (released Aug 24, 2026, 7 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 11.0.0, is not affected. ### [CVE-2026-71257](https://cve.now/CVE-2026-71257): Apache Wicket: Configured file upload limits are not enforced when the multipart request has already been parsed - Severity: High 7.5 - Published: Aug 31, 2026 - Affected: from 8.0.0, through 8.18.0; from 9.0.0, through 9.23.0; from 10.0.0, through 10.10.0. - Fixed in 10.11.0 (released Aug 24, 2026, 7 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 11.0.0, is not affected. ### [CVE-2026-70449](https://cve.now/CVE-2026-70449): Apache Wicket: Path traversal in resource style/variation/locale - Severity: Medium 5.3 - Published: Aug 31, 2026 - Affected: from 8.0.0, through 8.18.0; from 9.0.0, through 9.23.0; from 10.0.0, through 10.10.0. - Fixed in 10.11.0 (released Aug 24, 2026, 7 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 11.0.0, is not affected. ### [CVE-2026-66391](https://cve.now/CVE-2026-66391): Apache Wicket: leaked and missing CSP headers - Severity: Medium 6.5 - Published: Jul 27, 2026 - Affected: from 9.0.0, through 9.23.0; from 10.0.0, through 10.9.0. - Fixed in 10.9.1 (released May 16, 2026, 72 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 11.0.0, is not affected. ### [CVE-2026-66390](https://cve.now/CVE-2026-66390): Apache Wicket: crafted Link URL strings can break out of the JavaScript sequence - Severity: Medium 6.1 - Published: Jul 27, 2026 - Affected: from 9.0.0, through 9.23.0; from 10.0.0, through 10.9.0. - Fixed in 10.9.1 (released May 16, 2026, 72 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 11.0.0, is not affected. ### [CVE-2026-43975](https://cve.now/CVE-2026-43975): Apache Wicket: Possible malicious path traversal in FolderUploadsFileManager - Severity: Medium 6.5 - Published: May 6, 2026 - Affected: from 8.0.0-M1, through 8.17.0; from 9.0.0-M1, through 9.22.0; from 10.0.0-M1, fixed in 10.9.0. - Fixed in 10.9.0 (released Apr 30, 2026, 6 days before disclosure). - The latest release, 11.0.0, is not affected. ### [CVE-2024-53299](https://cve.now/CVE-2024-53299): Apache Wicket: An attacker can intentionally trigger a memory leak - Severity: Medium 6.5 - Published: Jan 23, 2025 - Affected: from 7.0.0, fixed in 8.17.0; from 10.0.0, fixed in 10.3.0; from 9.0.0-M1, fixed in 9.19.0. - Fixed in 8.17.0 (released Jan 27, 2025, 4 days after disclosure), 9.19.0 (released Dec 21, 2024, 33 days before disclosure) and 10.3.0 (released Dec 13, 2024, 41 days before disclosure). - The latest release, 11.0.0, is not affected. ### [CVE-2021-23937](https://cve.now/CVE-2021-23937): DNS proxy and possible amplification attack - Severity: Unrated - Published: May 25, 2021 - Affected: from 9.0.0, fixed in 9.3.0; from 8.0.0, fixed in 8.12.0; fixed in 7.18.0. - Fixed in 7.18.0 (released Apr 2, 2021, 53 days before disclosure), 8.12.0 (released Mar 30, 2021, 56 days before disclosure) and 9.3.0 (released Mar 25, 2021, 61 days before disclosure). - The latest release, 11.0.0, is not affected. ### [CVE-2020-11976](https://cve.now/CVE-2020-11976): By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. - Severity: Unrated - Published: Aug 11, 2020 - Affected: fixed in 7.17.0; from 8.0.0, fixed in 8.9.0; from 9.0.0-M1, fixed in 9.0.0; from 9.0.0-M2, fixed in 9.0.0; from 9.0.0-M3, fixed in 9.0.0; from 9.0.0-M4, fixed in 9.0.0; from 9.0.0-M5, fixed in 9.0.0. - Fixed in 7.17.0 (released Jul 16, 2020, 26 days before disclosure), 8.9.0 (released Jul 11, 2020, 31 days before disclosure) and 9.0.0 (released Jul 8, 2020, 34 days before disclosure). - The latest release, 11.0.0, is not affected. ### [CVE-2014-3526](https://cve.now/CVE-2014-3526): Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive information via… - Severity: Unrated - Published: Oct 30, 2017 - Affected: fixed in 1.5.12; from 6.0, fixed in 6.17.0; from 7.0.0-M1, fixed in 7.0.0-M3. - Fixed in 1.5.12 (released Sep 4, 2014, 1152 days before disclosure), 6.17.0 (released Aug 29, 2014, 1158 days before disclosure) and 7.0.0-M3 (released Aug 29, 2014, 1158 days before disclosure). - The latest release, 11.0.0, is not affected. ### [CVE-2016-6806](https://cve.now/CVE-2016-6806): Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin… - Severity: Unrated - Published: Oct 2, 2017 - Affected: from 6.20.0, fixed in 6.25.0; from 7.0.0, fixed in 7.5.0; from 8.0.0-M1, fixed in 8.0.0-M2. - Fixed in 6.25.0 (released Oct 19, 2016, 348 days before disclosure), 7.5.0 (released Oct 19, 2016, 348 days before disclosure) and 8.0.0-M2 (released Oct 19, 2016, 348 days before disclosure). - The latest release, 11.0.0, is not affected. ### [CVE-2014-0043](https://cve.now/CVE-2014-0043): In Apache Wicket 1.5.10 or 6.13.0, by issuing requests to special urls handled by Wicket, it is possible to check for the existence of… - Severity: Unrated - Published: Oct 2, 2017 - Affected: from 1.5-RC1, fixed in 1.5.11; from 6.0.0-beta1, fixed in 6.14.0. - Fixed in 1.5.11 (released Jan 20, 2014, 1351 days before disclosure) and 6.14.0 (released Feb 14, 2014, 1326 days before disclosure). - The latest release, 11.0.0, is not affected. ### [CVE-2014-7808](https://cve.now/CVE-2014-7808): Apache Wicket before 1.5.13, 6.x before 6.19.0, and 7.x before 7.0.0-M5 make it easier for attackers to defeat a cryptographic protection… - Severity: Unrated - Published: Sep 15, 2017 - Affected: fixed in 1.5.13; from 6.0.0-beta1, fixed in 6.19.0; from 7.0.0-M1, fixed in 7.0.0-M5. - Fixed in 1.5.13 (released Feb 9, 2015, 949 days before disclosure), 6.19.0 (released Jan 26, 2015, 963 days before disclosure) and 7.0.0-M5 (released Jan 26, 2015, 963 days before disclosure). - The latest release, 11.0.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.apache.wicket:wicket-core Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.