{"schema_version":1,"title":"Apache Wicket vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 23 vulnerabilities in Apache Wicket: 0 in the last 7 days and 19 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-95863, was published on 1 November 2026. 19 vulnerabilities in the last four weeks, up from none in the four before.","url":"https://junglewise.ai/threats/technologies/apache-wicket","json_url":"https://junglewise.ai/threats/technologies/apache-wicket.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/apache-wicket","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":1,"all_time":23,"critical":1,"exploited":0,"last_7_days":0,"last_30_days":19,"last_90_days":19,"last_365_days":23},"latest":[{"cve":"CVE-2026-95863","slug":"cve-2026-95863-improper-neutralization-of-input-during-web-page-generation-in","title":"Apache Wicket improper input neutralization in JavaScript generation","severity":"info","exploited":false,"published_at":"2026-11-01T23:17:30.943+00:00","url":"https://junglewise.ai/threats/cve-2026-95863-improper-neutralization-of-input-during-web-page-generation-in"},{"cve":"CVE-2026-87718","slug":"cve-2026-87718-apache-wicket-10-10-0-10-11-0-and-9-24-0-do-not-set-the-content","title":"Apache Wicket missing Content-Security-Policy headers with nested request handler delegates","severity":"info","exploited":false,"published_at":"2026-11-01T23:17:30.727+00:00","url":"https://junglewise.ai/threats/cve-2026-87718-apache-wicket-10-10-0-10-11-0-and-9-24-0-do-not-set-the-content"},{"cve":"CVE-2026-84231","slug":"cve-2026-84231-improper-neutralization-of-input-during-web-page-generation-in","title":"Apache Wicket ExternalLink reflected XSS in onclick attribute","severity":"info","exploited":false,"published_at":"2026-11-01T23:17:30.55+00:00","url":"https://junglewise.ai/threats/cve-2026-84231-improper-neutralization-of-input-during-web-page-generation-in"},{"cve":"CVE-2026-84177","slug":"cve-2026-84177-incorrect-behavior-order-in-apache-wicket-a-file-path-is","title":"Apache Wicket path validation bypass in package resource handling","severity":"info","exploited":false,"published_at":"2026-11-01T23:17:30.317+00:00","url":"https://junglewise.ai/threats/cve-2026-84177-incorrect-behavior-order-in-apache-wicket-a-file-path-is"},{"cve":"CVE-2026-84172","slug":"cve-2026-84172-files-accessible-to-external-parties-in-apache-wicket-org-apache","title":"Apache Wicket template disclosure via class loader misconfiguration","severity":"info","exploited":false,"published_at":"2026-11-01T23:17:30.113+00:00","url":"https://junglewise.ai/threats/cve-2026-84172-files-accessible-to-external-parties-in-apache-wicket-org-apache"},{"cve":"CVE-2026-84170","slug":"cve-2026-84170-allocation-of-resources-without-limits-or-throttling-in-apache","title":"Apache Wicket resource exhaustion in file upload without limits","severity":"info","exploited":false,"published_at":"2026-11-01T23:17:29.913+00:00","url":"https://junglewise.ai/threats/cve-2026-84170-allocation-of-resources-without-limits-or-throttling-in-apache"},{"cve":"CVE-2026-83594","slug":"cve-2026-83594-memory-allocation-with-an-excessive-size-value-in-apache-wicket","title":"Apache Wicket memory exhaustion in FileUploadToResourceField","severity":"info","exploited":false,"published_at":"2026-11-01T23:17:29.723+00:00","url":"https://junglewise.ai/threats/cve-2026-83594-memory-allocation-with-an-excessive-size-value-in-apache-wicket"},{"cve":"CVE-2026-83559","slug":"cve-2026-83559-improper-encoding-or-escaping-of-output-in-apache-wicket-org","title":"Apache Wicket improper escaping of quotes in JavaScript output","severity":"info","exploited":false,"published_at":"2026-11-01T23:17:29.513+00:00","url":"https://junglewise.ai/threats/cve-2026-83559-improper-encoding-or-escaping-of-output-in-apache-wicket-org"},{"cve":"CVE-2026-83539","slug":"cve-2026-83539-improper-neutralization-of-input-during-web-page-generation-in","title":"Apache Wicket XSS in SmartLinkLabel","severity":"info","exploited":false,"published_at":"2026-11-01T23:17:29.317+00:00","url":"https://junglewise.ai/threats/cve-2026-83539-improper-neutralization-of-input-during-web-page-generation-in"},{"cve":"CVE-2026-82956","slug":"cve-2026-82956-improper-neutralization-of-input-during-web-page-generation-in","title":"Apache Wicket cross-site scripting in AjaxNewWindowNotifyingBehavior","severity":"info","exploited":false,"published_at":"2026-11-01T23:17:29.13+00:00","url":"https://junglewise.ai/threats/cve-2026-82956-improper-neutralization-of-input-during-web-page-generation-in"},{"cve":"CVE-2026-111089","slug":"cve-2026-111089-apache-wicket-reads-texts-from-the-application-s-resource","title":"Apache Wicket XSS in resource bundle escaping","severity":"info","exploited":false,"published_at":"2026-11-01T23:17:28.697+00:00","url":"https://junglewise.ai/threats/cve-2026-111089-apache-wicket-reads-texts-from-the-application-s-resource"},{"cve":"CVE-2026-82898","slug":"cve-2026-82898-incorrect-order-of-security-checks-in-apache-wicket-org-apache","title":"Apache Wicket incorrect security check order in resource isolation","severity":"info","exploited":false,"published_at":"2026-11-01T22:17:48.217+00:00","url":"https://junglewise.ai/threats/cve-2026-82898-incorrect-order-of-security-checks-in-apache-wicket-org-apache"},{"cve":"CVE-2026-82840","slug":"cve-2026-82840-session-fixation-in-apache-wicket-org-apache-wicket-authroles","title":"Apache Wicket session fixation in authentication","severity":"info","exploited":false,"published_at":"2026-11-01T22:17:48.017+00:00","url":"https://junglewise.ai/threats/cve-2026-82840-session-fixation-in-apache-wicket-org-apache-wicket-authroles"},{"cve":"CVE-2026-82705","slug":"cve-2026-82705-missing-authorization-in-apache-wicket-org-apache-wicket","title":"Apache Wicket missing authorization in resource handlers","severity":"info","exploited":false,"published_at":"2026-11-01T22:17:47.82+00:00","url":"https://junglewise.ai/threats/cve-2026-82705-missing-authorization-in-apache-wicket-org-apache-wicket"},{"cve":"CVE-2026-82704","slug":"cve-2026-82704-missing-authorization-in-apache-wicket-org-apache-wicket-core","title":"Apache Wicket missing authorization in listener request handling","severity":"info","exploited":false,"published_at":"2026-11-01T22:17:47.583+00:00","url":"https://junglewise.ai/threats/cve-2026-82704-missing-authorization-in-apache-wicket-org-apache-wicket-core"},{"cve":"CVE-2026-82559","slug":"cve-2026-82559-insufficient-session-expiration-in-apache-wicket-org-apache","title":"Apache Wicket insufficient WebSocket session expiration","severity":"info","exploited":false,"published_at":"2026-11-01T22:17:47.37+00:00","url":"https://junglewise.ai/threats/cve-2026-82559-insufficient-session-expiration-in-apache-wicket-org-apache"},{"cve":"CVE-2026-82558","slug":"cve-2026-82558-missing-authorization-in-apache-wicket-org-apache-wicket-protocol","title":"Apache Wicket missing authorization in WebSocketBehavior","severity":"info","exploited":false,"published_at":"2026-11-01T22:17:47.187+00:00","url":"https://junglewise.ai/threats/cve-2026-82558-missing-authorization-in-apache-wicket-org-apache-wicket-protocol"},{"cve":"CVE-2026-82557","slug":"cve-2026-82557-missing-authorization-in-apache-wicket-org-apache-wicket-markup","title":"Apache Wicket missing authorization in form submission","severity":"info","exploited":false,"published_at":"2026-11-01T22:17:46.99+00:00","url":"https://junglewise.ai/threats/cve-2026-82557-missing-authorization-in-apache-wicket-org-apache-wicket-markup"},{"cve":"CVE-2026-82115","slug":"cve-2026-82115-missing-authorization-in-apache-wicket-org-apache-wicket-protocol","title":"Apache Wicket missing authorization in WebSocket handler","severity":"info","exploited":false,"published_at":"2026-11-01T22:17:46.777+00:00","url":"https://junglewise.ai/threats/cve-2026-82115-missing-authorization-in-apache-wicket-org-apache-wicket-protocol"},{"cve":"CVE-2026-43975","cvss":6.5,"epss":0.0073,"slug":"cve-2026-43975-apache-wicket-path-traversal-in-folderuploadsfilemanager","title":"Apache Wicket path traversal in FolderUploadsFileManager","severity":"medium","exploited":false,"published_at":"2026-05-06T10:16:26.163+00:00","url":"https://junglewise.ai/threats/cve-2026-43975-apache-wicket-path-traversal-in-folderuploadsfilemanager"},{"cve":"CVE-2026-43646","cvss":7.5,"epss":0.0039,"slug":"cve-2026-43646-apache-wicket-information-disclosure-in-packageresourceguard","title":"Apache Wicket information disclosure in PackageResourceGuard","severity":"high","exploited":false,"published_at":"2026-05-06T10:16:26.037+00:00","url":"https://junglewise.ai/threats/cve-2026-43646-apache-wicket-information-disclosure-in-packageresourceguard"},{"cve":"CVE-2026-42509","cvss":6.1,"epss":0.0036,"slug":"cve-2026-42509-apache-wicket-cross-site-scripting-in-web-page-generation","title":"Apache Wicket Cross-site Scripting in web page generation","severity":"medium","exploited":false,"published_at":"2026-05-06T10:16:20.217+00:00","url":"https://junglewise.ai/threats/cve-2026-42509-apache-wicket-cross-site-scripting-in-web-page-generation"},{"cve":"CVE-2026-40010","cvss":9.1,"epss":0.0038,"slug":"cve-2026-40010-apache-wicket-session-fixation-in-authenticatedwebsession","title":"Apache Wicket session fixation in AuthenticatedWebSession","severity":"critical","exploited":false,"published_at":"2026-05-06T10:16:20.093+00:00","url":"https://junglewise.ai/threats/cve-2026-40010-apache-wicket-session-fixation-in-authenticatedwebsession"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":19},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"Apache Airflow","slug":"airflow","vulnerabilities":95,"url":"https://junglewise.ai/threats/technologies/airflow"},{"name":"Apache Camel","slug":"camel","vulnerabilities":87,"url":"https://junglewise.ai/threats/technologies/camel"},{"name":"Apache Tomcat","slug":"tomcat","vulnerabilities":87,"url":"https://junglewise.ai/threats/technologies/tomcat"},{"name":"Apache Thrift","slug":"thrift","vulnerabilities":77,"url":"https://junglewise.ai/threats/technologies/thrift"},{"name":"Apache Ofbiz","slug":"ofbiz","vulnerabilities":67,"url":"https://junglewise.ai/threats/technologies/ofbiz"},{"name":"Apache HTTP Server","slug":"http-server","vulnerabilities":62,"url":"https://junglewise.ai/threats/technologies/http-server"},{"name":"Apache Traffic Server","slug":"traffic-server","vulnerabilities":55,"url":"https://junglewise.ai/threats/technologies/traffic-server"},{"name":"Apache Brpc","slug":"brpc","vulnerabilities":36,"url":"https://junglewise.ai/threats/technologies/brpc"},{"name":"Apache Roller","slug":"roller","vulnerabilities":30,"url":"https://junglewise.ai/threats/technologies/roller"},{"name":"Apache CloudStack","slug":"cloudstack","vulnerabilities":28,"url":"https://junglewise.ai/threats/technologies/cloudstack"},{"name":"Apache ActiveMQ","slug":"activemq","vulnerabilities":27,"url":"https://junglewise.ai/threats/technologies/activemq"},{"name":"Apache Apisix","slug":"apisix","vulnerabilities":27,"url":"https://junglewise.ai/threats/technologies/apisix"}],"technology":{"hub":true,"name":"Apache Wicket","slug":"apache-wicket","vendor":{"hub":true,"name":"Apache","slug":"apache","url":"https://junglewise.ai/threats/vendors/apache"},"aliases":[],"category":"framework","description":"Component-based Java web application framework.","url":"https://junglewise.ai/threats/technologies/apache-wicket"},"most_severe":[{"cve":"CVE-2026-40010","cvss":9.1,"epss":0.0038,"slug":"cve-2026-40010-apache-wicket-session-fixation-in-authenticatedwebsession","title":"Apache Wicket session fixation in AuthenticatedWebSession","severity":"critical","exploited":false,"published_at":"2026-05-06T10:16:20.093+00:00","url":"https://junglewise.ai/threats/cve-2026-40010-apache-wicket-session-fixation-in-authenticatedwebsession"},{"cve":"CVE-2026-43646","cvss":7.5,"epss":0.0039,"slug":"cve-2026-43646-apache-wicket-information-disclosure-in-packageresourceguard","title":"Apache Wicket information disclosure in PackageResourceGuard","severity":"high","exploited":false,"published_at":"2026-05-06T10:16:26.037+00:00","url":"https://junglewise.ai/threats/cve-2026-43646-apache-wicket-information-disclosure-in-packageresourceguard"},{"cve":"CVE-2026-43975","cvss":6.5,"epss":0.0073,"slug":"cve-2026-43975-apache-wicket-path-traversal-in-folderuploadsfilemanager","title":"Apache Wicket path traversal in FolderUploadsFileManager","severity":"medium","exploited":false,"published_at":"2026-05-06T10:16:26.163+00:00","url":"https://junglewise.ai/threats/cve-2026-43975-apache-wicket-path-traversal-in-folderuploadsfilemanager"},{"cve":"CVE-2026-42509","cvss":6.1,"epss":0.0036,"slug":"cve-2026-42509-apache-wicket-cross-site-scripting-in-web-page-generation","title":"Apache Wicket Cross-site Scripting in web page generation","severity":"medium","exploited":false,"published_at":"2026-05-06T10:16:20.217+00:00","url":"https://junglewise.ai/threats/cve-2026-42509-apache-wicket-cross-site-scripting-in-web-page-generation"},{"cve":"CVE-2026-95863","slug":"cve-2026-95863-improper-neutralization-of-input-during-web-page-generation-in","title":"Apache Wicket improper input neutralization in JavaScript generation","severity":"info","exploited":false,"published_at":"2026-11-01T23:17:30.943+00:00","url":"https://junglewise.ai/threats/cve-2026-95863-improper-neutralization-of-input-during-web-page-generation-in"},{"cve":"CVE-2026-87718","slug":"cve-2026-87718-apache-wicket-10-10-0-10-11-0-and-9-24-0-do-not-set-the-content","title":"Apache Wicket missing Content-Security-Policy headers with nested request handler delegates","severity":"info","exploited":false,"published_at":"2026-11-01T23:17:30.727+00:00","url":"https://junglewise.ai/threats/cve-2026-87718-apache-wicket-10-10-0-10-11-0-and-9-24-0-do-not-set-the-content"},{"cve":"CVE-2026-84231","slug":"cve-2026-84231-improper-neutralization-of-input-during-web-page-generation-in","title":"Apache Wicket ExternalLink reflected XSS in onclick attribute","severity":"info","exploited":false,"published_at":"2026-11-01T23:17:30.55+00:00","url":"https://junglewise.ai/threats/cve-2026-84231-improper-neutralization-of-input-during-web-page-generation-in"},{"cve":"CVE-2026-84177","slug":"cve-2026-84177-incorrect-behavior-order-in-apache-wicket-a-file-path-is","title":"Apache Wicket path validation bypass in package resource handling","severity":"info","exploited":false,"published_at":"2026-11-01T23:17:30.317+00:00","url":"https://junglewise.ai/threats/cve-2026-84177-incorrect-behavior-order-in-apache-wicket-a-file-path-is"},{"cve":"CVE-2026-84172","slug":"cve-2026-84172-files-accessible-to-external-parties-in-apache-wicket-org-apache","title":"Apache Wicket template disclosure via class loader misconfiguration","severity":"info","exploited":false,"published_at":"2026-11-01T23:17:30.113+00:00","url":"https://junglewise.ai/threats/cve-2026-84172-files-accessible-to-external-parties-in-apache-wicket-org-apache"},{"cve":"CVE-2026-84170","slug":"cve-2026-84170-allocation-of-resources-without-limits-or-throttling-in-apache","title":"Apache Wicket resource exhaustion in file upload without limits","severity":"info","exploited":false,"published_at":"2026-11-01T23:17:29.913+00:00","url":"https://junglewise.ai/threats/cve-2026-84170-allocation-of-resources-without-limits-or-throttling-in-apache"}],"generated_at":"2026-11-12T03:07:00.164048+00:00"}