CVE-2026-76983

Apache Wicket's AutoLabelTextResolver (registered by default in every WebApplication) writes form-component labels into markup unescaped , never consulting the escape-model-strings setting. When a label is set via FormComponent#setLabel(IModel) with attacker-influenced data, the result is a store...