Skip to content

CVE record · 1 source

CVE-2026-95863

CVSS 7.6

Improper neutralization of input during web page generation in Apache Wicket.

Vendor: Apache Software Foundation
Product: Apache Wicket
CVSS v4.0: 7.6 AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness: CWE-79
Exposure class: Web platform

Coverage

1

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

35

CVE NVD 2h ago

Improper neutralization of input during web page generation in Apache Wicket.

Improper neutralization of input during web page generation in Apache Wicket. Apache Wicket generates JavaScript that refers to the elements it renders, and writes into that JavaScript two values it derives itself: a component's…

CVSS 7.6 Fix available CVE-2026-95863 Apache Software Foundation