Skip to content
OpenAdvisories
Medium WID-SEC-2026-2547 2 CVEs

Apache Wicket: Mehrere Schwachstellen

Published Jul 27, 2026 · Updated Jul 27, 2026 · de-DE

Vendor: Apache Product: Wicket Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apache Wicket ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen und um Sicherheitsmaßnahmen zu umgehen.

Product

Apache Wicket ist ein komponentenbasiertes Web-Framework für die Programmiersprache Java.

Vulnerabilities 2

  • Medium 6.5
    CVE-2026-66391

    Apache Wicket: leaked and missing CSP headers

    Use of Insufficiently Random Values, Protection Mechanism Failure vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0. Users are recommended to upgrade to version 10.10.0, which fixes the iss…

    Apache Software Foundation Apache Wicket
  • Medium 6.1
    CVE-2026-66390

    Apache Wicket: crafted Link URL strings can break out of the JavaScript sequence

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0. Users are recommended to upgrade to version 10.10.0, …

    Apache Software Foundation Apache Wicket

Revision history

  1. #1

    Initiale Fassung

References