CVE-2026-66390

creationtimestamp| type| source ---|---|--- 2026-07-27 16:48:56+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mrndzrqhm622...

CVE-2026-66390 Apache Wicket: crafted Link URL strings can break out of the JavaScript sequence

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0. Users are recommended to upgrade to version 10.10.0, which fixes the issue...