# Apache Software Foundation Apache Wicket. Every CVE that names Apache Software Foundation Apache Wicket among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [Apache Wicket: XSS via a resource bundle text written unescaped into generated JavaScript and markup](https://agentprime.io/advisories/CVE-2026-111089.md) `CVE-2026-111089` · CVE record: Apache Software Foundation Apache Wicket · CVSS 7.6 High · Not analysed yet · Published 1 Nov 2026 · Tags: Cross-site scripting (XSS) - [Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markup](https://agentprime.io/advisories/CVE-2026-95863.md) `CVE-2026-95863` · CVE record: Apache Software Foundation Apache Wicket · CVSS 7.6 High · Not analysed yet · Published 1 Nov 2026 · Tags: Cross-site scripting (XSS) - [Apache Wicket: CSP headers silently omitted for pages served through nested request handler delegates](https://agentprime.io/advisories/CVE-2026-87718.md) `CVE-2026-87718` · CVE record: Apache Software Foundation Apache Wicket · CVSS 2.3 Low · Not analysed yet · Published 1 Nov 2026 · Tags: CWE-693 - [Apache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor tag](https://agentprime.io/advisories/CVE-2026-84231.md) `CVE-2026-84231` · CVE record: Apache Software Foundation Apache Wicket · CVSS 7.4 High · Not analysed yet · Published 1 Nov 2026 · Tags: Cross-site scripting (XSS) - [Apache Wicket: A component's markup is served as a package resource when its class name contains an underscore](https://agentprime.io/advisories/CVE-2026-84177.md) `CVE-2026-84177` · CVE record: Apache Software Foundation Apache Wicket · CVSS 6.3 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: CWE-179 - [Apache Wicket: Component markup is served as a package resource when wicket-core has its own class loader](https://agentprime.io/advisories/CVE-2026-84172.md) `CVE-2026-84172` · CVE record: Apache Software Foundation Apache Wicket · CVSS 6.3 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Information disclosure - [Apache Wicket: Configured upload limits are not enforced by the standalone file upload resource](https://agentprime.io/advisories/CVE-2026-84170.md) `CVE-2026-84170` · CVE record: Apache Software Foundation Apache Wicket · CVSS 8.3 High · Not analysed yet · Published 1 Nov 2026 · Tags: Denial of service - [Apache Wicket: FileUploadToResourceField accepts a client-asserted upload result and allocates the size it names](https://agentprime.io/advisories/CVE-2026-83594.md) `CVE-2026-83594` · CVE record: Apache Software Foundation Apache Wicket · CVSS 8.3 High · Not analysed yet · Published 1 Nov 2026 · Tags: Denial of service - [Apache Wicket: JavaScriptUtils#escapeQuotes does not escape the backslash, so its output can leave its string literal](https://agentprime.io/advisories/CVE-2026-83559.md) `CVE-2026-83559` · CVE record: Apache Software Foundation Apache Wicket · CVSS 7.4 High · Not analysed yet · Published 1 Nov 2026 · Tags: CWE-116 - [Apache Wicket: XSS in SmartLinkLabel and SmartLinkMultiLineLabel via a javascript: URL in the model data](https://agentprime.io/advisories/CVE-2026-83539.md) `CVE-2026-83539` · CVE record: Apache Software Foundation Apache Wicket · CVSS 7.4 High · Not analysed yet · Published 1 Nov 2026 · Tags: Cross-site scripting (XSS) - [Apache Wicket: XSS in AjaxNewWindowNotifyingBehavior via the client-supplied window name](https://agentprime.io/advisories/CVE-2026-82956.md) `CVE-2026-82956` · CVE record: Apache Software Foundation Apache Wicket · CVSS 7.6 High · Not analysed yet · Published 1 Nov 2026 · Tags: Cross-site scripting (XSS) - [Apache Wicket: A cross-origin listener invocation stopped by a login wall is replayed after the user signs in](https://agentprime.io/advisories/CVE-2026-82898.md) `CVE-2026-82898` · CVE record: Apache Software Foundation Apache Wicket · CVSS 2.1 Low · Not analysed yet · Published 1 Nov 2026 · Tags: CWE-696 - [Apache Wicket: The session id is renewed only on the first sign in, not on re-authentication](https://agentprime.io/advisories/CVE-2026-82840.md) `CVE-2026-82840` · CVE record: Apache Software Foundation Apache Wicket · CVSS 7.2 High · Not analysed yet · Published 1 Nov 2026 · Tags: Authentication bypass - [Apache Wicket: The configured authorization strategy is not applied to an IResource embedded in a component](https://agentprime.io/advisories/CVE-2026-82705.md) `CVE-2026-82705` · CVE record: Apache Software Foundation Apache Wicket · CVSS 6.3 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Broken access control - [Apache Wicket: A listener is invoked on a page instance the request itself created and never configured](https://agentprime.io/advisories/CVE-2026-82704.md) `CVE-2026-82704` · CVE record: Apache Software Foundation Apache Wicket · CVSS 6.9 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Broken access control - [Apache Wicket: WebSocket messages are processed against an HTTP session snapshot that survives invalidation](https://agentprime.io/advisories/CVE-2026-82559.md) `CVE-2026-82559` · CVE record: Apache Software Foundation Apache Wicket · CVSS 2.3 Low · Not analysed yet · Published 1 Nov 2026 · Tags: Authentication bypass - [Apache Wicket: WebSocketBehavior delivers client messages to a component the client may not invoke](https://agentprime.io/advisories/CVE-2026-82558.md) `CVE-2026-82558` · CVE record: Apache Software Foundation Apache Wicket · CVSS 2.3 Low · Not analysed yet · Published 1 Nov 2026 · Tags: Broken access control - [Apache Wicket: A disabled or invisible form submitting component is still invoked on a plain form submission](https://agentprime.io/advisories/CVE-2026-82557.md) `CVE-2026-82557` · CVE record: Apache Software Foundation Apache Wicket · CVSS 6.9 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Broken access control - [Apache Wicket: The configured authorization strategy is not applied to a shared WebSocketResource](https://agentprime.io/advisories/CVE-2026-82115.md) `CVE-2026-82115` · CVE record: Apache Software Foundation Apache Wicket · CVSS 6.3 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Broken access control - [Apache Wicket: XSS in AbstractSingleSelectChoice via getNullValidDisplayValue](https://agentprime.io/advisories/CVE-2026-76986.md) `CVE-2026-76986` · CVE record: Apache Software Foundation Apache Wicket · CVSS 6.1 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS) - [Apache Wicket: XSS in Palette via getAdditionalAttributes](https://agentprime.io/advisories/CVE-2026-76985.md) `CVE-2026-76985` · CVE record: Apache Software Foundation Apache Wicket · CVSS 5.1 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS) - [Apache Wicket: XSS in AutoLabelTextResolver via FormComponent.setLabel](https://agentprime.io/advisories/CVE-2026-76983.md) `CVE-2026-76983` · CVE record: Apache Software Foundation Apache Wicket · CVSS 5.1 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS) - [Apache Wicket: XSS in MetaDataHeaderItem via addTagAttribute](https://agentprime.io/advisories/CVE-2026-76984.md) `CVE-2026-76984` · CVE record: Apache Software Foundation Apache Wicket · CVSS 5.1 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS) - [Apache Wicket: XSS in Button via its model object](https://agentprime.io/advisories/CVE-2026-76982.md) `CVE-2026-76982` · CVE record: Apache Software Foundation Apache Wicket · CVSS 5.1 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS) - [Apache Wicket: XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and defaultNullLabel](https://agentprime.io/advisories/CVE-2026-75802.md) `CVE-2026-75802` · CVE record: Apache Software Foundation Apache Wicket · CVSS 5.1 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS) - [Apache Wicket: Cross-Site Request Forgery (CSRF) protection bypass in ResourceIsolationRequestCycleListener](https://agentprime.io/advisories/CVE-2026-71378.md) `CVE-2026-71378` · CVE record: Apache Software Foundation Apache Wicket · CVSS 4.6 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site request forgery (CSRF) - [Apache Wicket: Configured file upload limits are not enforced when the multipart request has already been parsed](https://agentprime.io/advisories/CVE-2026-71257.md) `CVE-2026-71257` · CVE record: Apache Software Foundation Apache Wicket · CVSS 7.5 High · Not analysed yet · Published 31 Aug 2026 · Tags: Denial of service - [Apache Wicket: Path traversal in resource style/variation/locale](https://agentprime.io/advisories/CVE-2026-70449.md) `CVE-2026-70449` · CVE record: Apache Software Foundation Apache Wicket · CVSS 5.3 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Path traversal - [Apache Wicket: leaked and missing CSP headers](https://agentprime.io/advisories/CVE-2026-66391.md) `CVE-2026-66391` · CVE record: Apache Software Foundation Apache Wicket · CVSS 6.5 Medium · Not analysed yet · Published 27 Jul 2026 · Tags: Weak cryptography or TLS, CWE-693 - [Apache Wicket: crafted Link URL strings can break out of the JavaScript sequence](https://agentprime.io/advisories/CVE-2026-66390.md) `CVE-2026-66390` · CVE record: Apache Software Foundation Apache Wicket · CVSS 6.1 Medium · Not analysed yet · Published 27 Jul 2026 · Tags: Cross-site scripting (XSS) ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .