CVE-2026-87718

Apache Wicket versions 10.10.0, 10.11.0, and 9.24.0 are vulnerable to a flaw where Content-Security-Policy (CSP) headers are silently omitted. This occurs when a page's render request handler is wrapped in more than one IRequestHandlerDelegate , as the framework only unwraps a single delegate lev...