EUVD-2026-114902

Apache Wicket 10.10.0, 10.11.0 and 9.24.0 do not set the Content-Security-Policy headers on a page whose render request handler is wrapped in more than one IRequestHandlerDelegate. The framework unwraps only a single delegate level when deciding whether a request renders a page, so with a deeper...

CVE-2026-87718

Apache Wicket versions 10.10.0, 10.11.0, and 9.24.0 are vulnerable to a flaw where Content-Security-Policy (CSP) headers are silently omitted. This occurs when a page's render request handler is wrapped in more than one IRequestHandlerDelegate , as the framework only unwraps a single delegate lev...