EUVD-2026-114894

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.ajax.AjaxNewWindowNotifyingBehavior notices that a page instance has been opened in a second browser window or tab. It asks the browser for the value of window.name, which reaches the server as the...

CVE-2026-82956

Apache Wicket is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of input in the AjaxNewWindowNotifyingBehavior component. The vulnerability occurs because the component stores the client-supplied window.name value in the page's serialized state. During subsequent renders,...