EUVD-2026-114895

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.extensions.markup.html.basic.SmartLinkLabel and org.apache.wicket.extensions.markup.html.basic.SmartLinkMultiLineLabel display a text value and turn any URL they find in it into a hyperlink. Both escap...

CVE-2026-83539

Apache Wicket versions 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0 are vulnerable to Cross-Site Scripting (XSS) . The issue exists in the SmartLinkLabel and SmartLinkMultiLineLabel components, which use DefaultLinkParser to automatically convert URLs found in text into ...