CVE-2026-83539

Apache Wicket versions 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0 are vulnerable to Cross-Site Scripting (XSS) . The issue exists in the SmartLinkLabel and SmartLinkMultiLineLabel components, which use DefaultLinkParser to automatically convert URLs found in text into ...