CVE-2026-82704

Vendor

Apache Software Foundation

Product

Apache Wicket

CVSS v4.0

6.9 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness

CWE-862

Exposure class

Web platform

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

1. 28
   CVE NVD 1h ago

   Missing authorization in Apache Wicket. org.apache.wicket.core.request.handler.ListenerRequestHandler invokes an IRequestListener only when…

   Missing authorization in Apache Wicket. org.apache.wicket.core.request.handler.ListenerRequestHandler invokes an IRequestListener only when org.apache.wicket.Component#canCallListener() allows it, and that method is…

   CVSS 6.9 Fix available CVE-2026-82704 Apache Software Foundation