agentprime: apache-software-foundation-apache-wicket

agentprime: apache-software-foundation-apache-wicketEvery new CVE for apache-software-foundation-apache-wicket.https://agentprime.io/CVE-2026-111089: Apache Wicket: XSS via a resource bundle text written unescaped into generated JavaScript and markuphttps://agentprime.io/advisories/CVE-2026-111089/https://agentprime.io/advisories/CVE-2026-111089/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Sun, 01 Nov 2026 22:32:09 GMTCVECVE-2026-95863: Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markuphttps://agentprime.io/advisories/CVE-2026-95863/https://agentprime.io/advisories/CVE-2026-95863/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Sun, 01 Nov 2026 22:30:47 GMTCVECVE-2026-87718: Apache Wicket: CSP headers silently omitted for pages served through nested request handler delegateshttps://agentprime.io/advisories/CVE-2026-87718/https://agentprime.io/advisories/CVE-2026-87718/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Sun, 01 Nov 2026 22:28:35 GMTCVECVE-2026-84231: Apache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor taghttps://agentprime.io/advisories/CVE-2026-84231/https://agentprime.io/advisories/CVE-2026-84231/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Sun, 01 Nov 2026 22:26:18 GMTCVECVE-2026-84177: Apache Wicket: A component's markup is served as a package resource when its class name contains an underscorehttps://agentprime.io/advisories/CVE-2026-84177/https://agentprime.io/advisories/CVE-2026-84177/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 01 Nov 2026 22:25:22 GMTCVECVE-2026-84172: Apache Wicket: Component markup is served as a package resource when wicket-core has its own class loaderhttps://agentprime.io/advisories/CVE-2026-84172/https://agentprime.io/advisories/CVE-2026-84172/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 01 Nov 2026 22:24:14 GMTCVECVE-2026-84170: Apache Wicket: Configured upload limits are not enforced by the standalone file upload resourcehttps://agentprime.io/advisories/CVE-2026-84170/https://agentprime.io/advisories/CVE-2026-84170/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Sun, 01 Nov 2026 22:22:48 GMTCVECVE-2026-83594: Apache Wicket: FileUploadToResourceField accepts a client-asserted upload result and allocates the size it nameshttps://agentprime.io/advisories/CVE-2026-83594/https://agentprime.io/advisories/CVE-2026-83594/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Sun, 01 Nov 2026 22:21:13 GMTCVECVE-2026-83559: Apache Wicket: JavaScriptUtils#escapeQuotes does not escape the backslash, so its output can leave its string literalhttps://agentprime.io/advisories/CVE-2026-83559/https://agentprime.io/advisories/CVE-2026-83559/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Sun, 01 Nov 2026 22:19:47 GMTCVECVE-2026-83539: Apache Wicket: XSS in SmartLinkLabel and SmartLinkMultiLineLabel via a javascript: URL in the model datahttps://agentprime.io/advisories/CVE-2026-83539/https://agentprime.io/advisories/CVE-2026-83539/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Sun, 01 Nov 2026 22:18:13 GMTCVECVE-2026-82956: Apache Wicket: XSS in AjaxNewWindowNotifyingBehavior via the client-supplied window namehttps://agentprime.io/advisories/CVE-2026-82956/https://agentprime.io/advisories/CVE-2026-82956/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Sun, 01 Nov 2026 22:16:45 GMTCVECVE-2026-82898: Apache Wicket: A cross-origin listener invocation stopped by a login wall is replayed after the user signs inhttps://agentprime.io/advisories/CVE-2026-82898/https://agentprime.io/advisories/CVE-2026-82898/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Sun, 01 Nov 2026 22:14:06 GMTCVECVE-2026-82840: Apache Wicket: The session id is renewed only on the first sign in, not on re-authenticationhttps://agentprime.io/advisories/CVE-2026-82840/https://agentprime.io/advisories/CVE-2026-82840/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Sun, 01 Nov 2026 22:05:07 GMTCVECVE-2026-82705: Apache Wicket: The configured authorization strategy is not applied to an IResource embedded in a componenthttps://agentprime.io/advisories/CVE-2026-82705/https://agentprime.io/advisories/CVE-2026-82705/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 01 Nov 2026 22:03:23 GMTCVECVE-2026-82704: Apache Wicket: A listener is invoked on a page instance the request itself created and never configuredhttps://agentprime.io/advisories/CVE-2026-82704/https://agentprime.io/advisories/CVE-2026-82704/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 01 Nov 2026 22:01:51 GMTCVECVE-2026-82559: Apache Wicket: WebSocket messages are processed against an HTTP session snapshot that survives invalidationhttps://agentprime.io/advisories/CVE-2026-82559/https://agentprime.io/advisories/CVE-2026-82559/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Sun, 01 Nov 2026 22:00:24 GMTCVECVE-2026-82558: Apache Wicket: WebSocketBehavior delivers client messages to a component the client may not invokehttps://agentprime.io/advisories/CVE-2026-82558/https://agentprime.io/advisories/CVE-2026-82558/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Sun, 01 Nov 2026 21:58:28 GMTCVECVE-2026-82557: Apache Wicket: A disabled or invisible form submitting component is still invoked on a plain form submissionhttps://agentprime.io/advisories/CVE-2026-82557/https://agentprime.io/advisories/CVE-2026-82557/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 01 Nov 2026 21:56:01 GMTCVECVE-2026-82115: Apache Wicket: The configured authorization strategy is not applied to a shared WebSocketResourcehttps://agentprime.io/advisories/CVE-2026-82115/https://agentprime.io/advisories/CVE-2026-82115/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 01 Nov 2026 21:42:45 GMTCVECVE-2026-76986: Apache Wicket: XSS in AbstractSingleSelectChoice via getNullValidDisplayValuehttps://agentprime.io/advisories/CVE-2026-76986/https://agentprime.io/advisories/CVE-2026-76986/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 31 Aug 2026 13:25:10 GMTCVECVE-2026-76985: Apache Wicket: XSS in Palette via getAdditionalAttributeshttps://agentprime.io/advisories/CVE-2026-76985/https://agentprime.io/advisories/CVE-2026-76985/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 31 Aug 2026 13:22:18 GMTCVECVE-2026-76983: Apache Wicket: XSS in AutoLabelTextResolver via FormComponent.setLabelhttps://agentprime.io/advisories/CVE-2026-76983/https://agentprime.io/advisories/CVE-2026-76983/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 31 Aug 2026 11:56:38 GMTCVECVE-2026-76984: Apache Wicket: XSS in MetaDataHeaderItem via addTagAttributehttps://agentprime.io/advisories/CVE-2026-76984/https://agentprime.io/advisories/CVE-2026-76984/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 31 Aug 2026 11:56:15 GMTCVECVE-2026-76982: Apache Wicket: XSS in Button via its model objecthttps://agentprime.io/advisories/CVE-2026-76982/https://agentprime.io/advisories/CVE-2026-76982/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 31 Aug 2026 11:52:26 GMTCVECVE-2026-75802: Apache Wicket: XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and defaultNullLabelhttps://agentprime.io/advisories/CVE-2026-75802/https://agentprime.io/advisories/CVE-2026-75802/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 31 Aug 2026 11:52:17 GMTCVECVE-2026-71378: Apache Wicket: Cross-Site Request Forgery (CSRF) protection bypass in ResourceIsolationRequestCycleListenerhttps://agentprime.io/advisories/CVE-2026-71378/https://agentprime.io/advisories/CVE-2026-71378/CVSS 4.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 31 Aug 2026 11:46:27 GMTCVECVE-2026-71257: Apache Wicket: Configured file upload limits are not enforced when the multipart request has already been parsedhttps://agentprime.io/advisories/CVE-2026-71257/https://agentprime.io/advisories/CVE-2026-71257/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 31 Aug 2026 11:45:49 GMTCVECVE-2026-70449: Apache Wicket: Path traversal in resource style/variation/localehttps://agentprime.io/advisories/CVE-2026-70449/https://agentprime.io/advisories/CVE-2026-70449/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 31 Aug 2026 11:44:14 GMTCVECVE-2026-66391: Apache Wicket: leaked and missing CSP headershttps://agentprime.io/advisories/CVE-2026-66391/https://agentprime.io/advisories/CVE-2026-66391/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 27 Jul 2026 16:45:17 GMTCVECVE-2026-66390: Apache Wicket: crafted Link URL strings can break out of the JavaScript sequencehttps://agentprime.io/advisories/CVE-2026-66390/https://agentprime.io/advisories/CVE-2026-66390/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 27 Jul 2026 16:39:11 GMTCVE