Product · Apache Software Foundation

Apache Wicket

40 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

Critical 9.1

CVE-2026-40010

Apache Wicket: possible session fixation using AuthenticatedWebSession

Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a session fixation attack in Apache Wicket. This issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0. Users …

Apache Software Foundation Apache Wicket org.apache.wicket:wicket-auth-roles Maven

May 6, 2026
Critical 9.8

CVE-2024-36522

Apache Wicket: Remote code execution via XSLT injection

The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation. Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix …

Apache Software Foundation Apache Wicket org.apache.wicket:wicket-util Maven

Jul 12, 2024