Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.wicket:wicket-extensions

3 known vulnerabilities (1 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
11.0.0 (Nov 2, 2026): no advisory affects it
Newest unaffected release
11.0.0 (Nov 2, 2026), the latest release
Advisories
3 · 1 high, 2 medium
Dependents
47
Releases
215 since 1.3.0 (Jan 1, 2008)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-83539
    Affects 8.0.0 to 8.19.0 (8.20.0 is outside it); 9.0.0 to 9.24.0 (9.25.0 is outside it); 10.0.0 to 10.11.0 (10.12.0 is outside it)
  • CVE-2026-76985
    Affects 8.0.0 to 8.18.0 (8.19.0 is outside it); 9.0.0 to 9.23.0 (9.24.0 is outside it); 10.0.0 to 10.10.0 (10.11.0 is outside it)
  • CVE-2026-75802
    Affects 8.0.0 to 8.18.0 (8.19.0 is outside it); 9.0.0 to 9.23.0 (9.24.0 is outside it); 10.0.0 to 10.10.0 (10.11.0 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 3

  • Apache Wicket: XSS in SmartLinkLabel and SmartLinkMultiLineLabel via a javascript: URL in the model data

    Affected: from 8.0.0, through 8.19.0; from 9.0.0, through 9.24.0; from 10.0.0, through 10.11.0.

    Fixed in 10.12.0 (released Nov 1, 2026, the day of disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 11.0.0, is not affected.

  • CVE-2026-76985Medium 5.1

    Apache Wicket: XSS in Palette via getAdditionalAttributes

    Affected: from 8.0.0, through 8.18.0; from 9.0.0, through 9.23.0; from 10.0.0, through 10.10.0.

    Fixed in 10.11.0 (released Aug 24, 2026, 7 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 11.0.0, is not affected.

  • CVE-2026-75802Medium 5.1

    Apache Wicket: XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and defaultNullLabel

    Affected: from 8.0.0, through 8.18.0; from 9.0.0, through 9.23.0; from 10.0.0, through 10.10.0.

    Fixed in 10.11.0 (released Aug 24, 2026, 7 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 11.0.0, is not affected.