CVE-2026-87718

🗓️ 01 Nov 2026 22:28:35Reported by MendType

Apache Wicket fails to set CSP headers when multiple IRequestHandlerDelegates are used.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2026-87718	1 Nov 202615:17	–	circl
CNNVD	Apache Wicket processing logic error vulnerability	1 Nov 202600:00	–	cnnvd
CVE	CVE-2026-87718	1 Nov 202622:28	–	cve
Cvelist	CVE-2026-87718 Apache Wicket: CSP headers silently omitted for pages served through nested request handler delegates	1 Nov 202622:28	–	cvelist
EUVD	EUVD-2026-114902	2 Nov 202600:30	–	euvd
NVD	CVE-2026-87718	1 Nov 202623:17	–	nvd
Positive Technologies	PT-2026-135056	1 Nov 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-87718: Apache Software Foundation Apache Wicket: Apache Wicket 10.10.0, 10.11.0 and 9.24.0 do not set the Content-Security-Policy headers on a page whose render request…	1 Nov 202600:00	–	rapid7
vulnersOsv	com.googlecode.wicket-jquery-ui:wicket-jquery-ui (9.24.0), com.googlecode.wicket-jquery-ui:wicket-jquery-ui-calendar (9.24.0) +223 more potentially affected by CVE-2026-87718 via org.apache.wicket:wicket-request (9.24.0)	1 Nov 202622:28	–	vulnersosv
vulnersOsv	com.antiliacode.widgets:ui-components (>=10.11.0-rc1, <=10.11.0-rc5), com.vegardit.no-npe:no-npe-eea-wicket-10 (>=1.3.14, <=2.0.1) +249 more potentially affected by CVE-2026-87718 via org.apache.wicket:wicket-request (>=10.10.0, <=10.11.0)	1 Nov 202622:28	–	vulnersosv