Known vulnerabilities in Apache Wicket

Vendor: Apache Foundation
Software: Apache Wicket
Software CPE: cpe:2.3:a:apache_foundation:apache_wicket:*:*:*:*:*:*:*:*
Website: https://www.apache.org
Total vulnerabilities: 22
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Apache Wicket Apache Wicket is affected by 22 known vulnerabilities: 2 high, 16 medium, 4 low Critical High Medium Low

Vulnerabilities (22)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU146326 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-75802		 CWE-79 Medium
No
No
 8.19.0, 9.24.0, 10.11.0 31.08.2026 SB2026083129
#VU146325 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-76982		 CWE-79 Medium
No
No
 8.19.0, 9.24.0, 10.11.0 31.08.2026 SB2026083129
#VU146324 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-76983		 CWE-79 Medium
No
No
 8.19.0, 9.24.0, 10.11.0 31.08.2026 SB2026083129
#VU146323 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-76984		 CWE-79 Medium
No
No
 8.19.0, 9.24.0, 10.11.0 31.08.2026 SB2026083129
#VU146322 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-76985		 CWE-79 Medium
No
No
 8.19.0, 9.24.0, 10.11.0 31.08.2026 SB2026083129
#VU146321 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-76986		 CWE-79 Medium
No
No
 8.19.0, 9.24.0, 10.11.0 31.08.2026 SB2026083129
#VU146319 - Cross-Site Request Forgery (CSRF)
CVE-2026-71378		 CWE-352 Medium
No
No
 9.24.0, 10.11.0 31.08.2026 SB2026083129
#VU146318 - Allocation of Resources Without Limits or Throttling
CVE-2026-71257		 CWE-770 Medium
No
No
 8.19.0, 9.24.0, 10.11.0 31.08.2026 SB2026083129
#VU146317 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-70449		 CWE-22 Medium
No
No
 8.19.0, 9.24.0, 10.11.0 31.08.2026 SB2026083129
#VU145309 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-43975		 CWE-22 High
No
No
 10.9.0 25.08.2026 SB20260825100
#VU145308 - Improper Access Control
CVE-2026-43646		 CWE-284 Medium
No
No
 10.9.0 25.08.2026 SB20260825100
#VU145307 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-42509		 CWE-79 Medium
No
No
 10.9.0 25.08.2026 SB20260825100
#VU145306 - Session Fixation
CVE-2026-40010		 CWE-384 Low
No
No
 10.9.0 25.08.2026 SB20260825100
#VU144755 - Protection Mechanism Failure
CVE-2026-66391		 CWE-693 Medium
No
No
 10.10.0 24.08.2026 SB20260824136
#VU144754 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-66390		 CWE-79 Medium
No
No
 10.10.0 24.08.2026 SB20260824136
#VU101869 - Missing release of memory after effective lifetime
CVE-2024-53299		 CWE-401 Medium
No
No
 10.3.0 19.12.2024 SB2024121933
#VU91169 - Improper Control of Generation of Code ('Code Injection')
CVE-2024-36522		 CWE-94 High
No
No
 9.18.0, 10.1.0 05.06.2024 SB2024060531
#VU87557 - Cross-Site Request Forgery (CSRF)
CVE-2024-27439		 CWE-352 Medium
No
No
 10.0.0 15.03.2024 SB2024031523
#VU53532 - Improper input validation
CVE-2021-23937		 CWE-20 Medium
No
No
 7.18.0, 8.12.0, 9.3.0 25.05.2021 SB2021052532
#VU8587 - Deserialization of Untrusted Data
CVE-2016-6793		 CWE-502 Low
No
No
 - 22.09.2017 SB2016123101


Showing elements 1 - 20 out of 22