Unauthenticated Arbitrary File Disclosure

org.apache.wicket, wicket-core is vulnerable to an unauthenticated arbitrary file disclosure. The vulnerability is due to improper validation of attacker-controlled locale, style, and variation URL attributes before they are appended to the resource path, which allows an attacker to use path...

Improper Neutralization Of Input During Web Page Generation

org.apache.wicket, wicket-core is vulnerable to improper neutralization of input during web page generation. The vulnerability is due to the resolver rendering attacker-influenced label values without escaping, which allows an attacker to inject malicious markup or script content into a web page...

be.personify.iam:personify-frontend (>=1.5.1.release, <=1.5.8.release), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-context (>=4.0.0-m1, <=5.0.0) +368 more potentially affected by CVE-2026-71257 via org.apache.wicket:wicket-core (>=10.0.0-m1, <=10.10.0)

org.apache.wicket:wicket-core MAVEN version =10.0.0-m1, =1.5.1.release, =4.0.0-m1, =4.0.0-m1, =5.0.0 - com.googlecode.wicket-jquery-ui:wicket-jquery-ui 10.0.0-m1 - com.googlecode.wicket-jquery-ui:wicket-jquery-ui-calendar 10.0.0-m1 - com.googlecode.wicket-jquery-ui:wicket-jquery-ui-core 10.0.0-m1...

be.personify.iam:personify-frontend (>=1.3.1.release, <=1.4.2.release), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-context (>=3.0.1-rc, <=3.1.7) +379 more potentially affected by CVE-2026-71257 via org.apache.wicket:wicket-core (>=9.0.0-m1, <=9.23.0)

org.apache.wicket:wicket-core MAVEN version =9.0.0-m1, =1.3.1.release, =3.0.1-rc, =3.0.1-rc, =9.0.0-m2, =9.0.0-m2, =9.0.0-m2, =9.18.0, =9.0.0-m2, =9.0.0-m3, =9.0.0-m2, =9.0.0-m2, =9.0.0-m2, =9.0.0-m2, =9.23.1 and more Source cves: CVE-2026-71257https:/...

Directory Traversal

Overview org.apache.wicket:wicket-core is a Java web application framework that takes simplicity, separation of concerns and ease of development to a whole new level. Wicket pages can be mocked up, previewed and later revised using standard WYSIWYG HTML design tools. Dynamic content processing an...

at.austriapro:ebinterface-web (>=1.0.8, <=1.0.9), com.angkorteam.framework.extension:framework-extension (>=2.2.2, <=3.0.2) +437 more potentially affected by CVE-2026-70449 via org.apache.wicket:wicket-core (>=8.0.0-m1, <=8.18.0)

org.apache.wicket:wicket-core MAVEN version =8.0.0-m1, =1.0.8, =2.2.2, =1.1.0, =2.0.0, =2.0.0, =2.0.0, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.14.0 - com.googlecode.wicket-jquery-ui:wicket-jquery-ui-samples 8.0.0-m1.1 and more Source cves: CVE-2026-70449 Source advisory:...

be.personify.iam:personify-frontend (>=1.3.1.release, <=1.4.2.release), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-context (>=3.0.1-rc, <=3.1.7) +379 more potentially affected by CVE-2026-70449 via org.apache.wicket:wicket-core (>=9.0.0-m1, <=9.23.0)

org.apache.wicket:wicket-core MAVEN version =9.0.0-m1, =1.3.1.release, =3.0.1-rc, =3.0.1-rc, =9.0.0-m2, =9.0.0-m2, =9.0.0-m2, =9.18.0, =9.0.0-m2, =9.0.0-m3, =9.0.0-m2, =9.0.0-m2, =9.0.0-m2, =9.0.0-m2, =9.23.1 and more Source cves: CVE-2026-70449https:/...

be.personify.iam:personify-frontend (>=1.5.1.release, <=1.5.8.release), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-context (>=4.0.0-m1, <=5.0.0) +357 more potentially affected by CVE-2026-70449 via org.apache.wicket:wicket-core (>=10.0.0-m1, <=10.9.1)

org.apache.wicket:wicket-core MAVEN version =10.0.0-m1, =1.5.1.release, =4.0.0-m1, =4.0.0-m1, =5.0.0 - com.googlecode.wicket-jquery-ui:wicket-jquery-ui 10.0.0-m1 - com.googlecode.wicket-jquery-ui:wicket-jquery-ui-calendar 10.0.0-m1 - com.googlecode.wicket-jquery-ui:wicket-jquery-ui-core 10.0.0-m1...

Cross-site Request Forgery (CSRF)

Overview org.apache.wicket:wicket-core is a Java web application framework that takes simplicity, separation of concerns and ease of development to a whole new level. Wicket pages can be mocked up, previewed and later revised using standard WYSIWYG HTML design tools. Dynamic content processing an...

be.personify.iam:personify-frontend (>=1.3.1.release, <=1.4.2.release), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-context (>=3.1.5, <=3.1.7) +364 more potentially affected by CVE-2026-71378 via org.apache.wicket:wicket-core (>=9.1.0, <=9.23.0)

org.apache.wicket:wicket-core MAVEN version =9.1.0, =1.3.1.release, =3.1.5, =3.1.5, =9.1.0, =9.1.0, =9.1.0, =9.18.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =9.1.0, =9.23.1 and more Source cves: CVE-2026-71378https://vul...

be.personify.iam:personify-frontend (>=1.5.1.release, <=1.5.8.release), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-context (>=4.0.0-m1, <=5.0.0) +368 more potentially affected by CVE-2026-71378 via org.apache.wicket:wicket-core (>=10.0.0-m1, <=10.10.0)

org.apache.wicket:wicket-core MAVEN version =10.0.0-m1, =1.5.1.release, =4.0.0-m1, =4.0.0-m1, =5.0.0 - com.googlecode.wicket-jquery-ui:wicket-jquery-ui 10.0.0-m1 - com.googlecode.wicket-jquery-ui:wicket-jquery-ui-calendar 10.0.0-m1 - com.googlecode.wicket-jquery-ui:wicket-jquery-ui-core 10.0.0-m1...

Cross-site Scripting (XSS)

Overview org.apache.wicket:wicket-core is a Java web application framework that takes simplicity, separation of concerns and ease of development to a whole new level. Wicket pages can be mocked up, previewed and later revised using standard WYSIWYG HTML design tools. Dynamic content processing an...

be.personify.iam:personify-frontend (>=1.3.1.release, <=1.4.2.release), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-context (>=3.0.1-rc, <=3.1.7) +379 more potentially affected by CVE-2026-76982 via org.apache.wicket:wicket-core (>=9.0.0-m1, <=9.23.0)

org.apache.wicket:wicket-core MAVEN version =9.0.0-m1, =1.3.1.release, =3.0.1-rc, =3.0.1-rc, =9.0.0-m2, =9.0.0-m2, =9.0.0-m2, =9.18.0, =9.0.0-m2, =9.0.0-m3, =9.0.0-m2, =9.0.0-m2, =9.0.0-m2, =9.0.0-m2, =9.23.1 and more Source cves: CVE-2026-76982https:/...

be.personify.iam:personify-frontend (>=1.5.1.release, <=1.5.8.release), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-context (>=4.0.0-m1, <=5.0.0) +368 more potentially affected by CVE-2026-76982 via org.apache.wicket:wicket-core (>=10.0.0-m1, <=10.10.0)

org.apache.wicket:wicket-core MAVEN version =10.0.0-m1, =1.5.1.release, =4.0.0-m1, =4.0.0-m1, =5.0.0 - com.googlecode.wicket-jquery-ui:wicket-jquery-ui 10.0.0-m1 - com.googlecode.wicket-jquery-ui:wicket-jquery-ui-calendar 10.0.0-m1 - com.googlecode.wicket-jquery-ui:wicket-jquery-ui-core 10.0.0-m1...

Cross-site Scripting (XSS)

Overview org.apache.wicket:wicket-core is a Java web application framework that takes simplicity, separation of concerns and ease of development to a whole new level. Wicket pages can be mocked up, previewed and later revised using standard WYSIWYG HTML design tools. Dynamic content processing an...

be.personify.iam:personify-frontend (>=1.3.1.release, <=1.4.2.release), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-context (>=3.0.1-rc, <=3.1.7) +379 more potentially affected by CVE-2026-76984 via org.apache.wicket:wicket-core (>=9.0.0-m1, <=9.23.0)

org.apache.wicket:wicket-core MAVEN version =9.0.0-m1, =1.3.1.release, =3.0.1-rc, =3.0.1-rc, =9.0.0-m2, =9.0.0-m2, =9.0.0-m2, =9.18.0, =9.0.0-m2, =9.0.0-m3, =9.0.0-m2, =9.0.0-m2, =9.0.0-m2, =9.0.0-m2, =9.23.1 and more Source cves: CVE-2026-76984https:/...

be.personify.iam:personify-frontend (>=1.5.1.release, <=1.5.8.release), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-context (>=4.0.0-m1, <=5.0.0) +368 more potentially affected by CVE-2026-76984 via org.apache.wicket:wicket-core (>=10.0.0-m1, <=10.10.0)

org.apache.wicket:wicket-core MAVEN version =10.0.0-m1, =1.5.1.release, =4.0.0-m1, =4.0.0-m1, =5.0.0 - com.googlecode.wicket-jquery-ui:wicket-jquery-ui 10.0.0-m1 - com.googlecode.wicket-jquery-ui:wicket-jquery-ui-calendar 10.0.0-m1 - com.googlecode.wicket-jquery-ui:wicket-jquery-ui-core 10.0.0-m1...

Cross-site Scripting (XSS)

Overview org.apache.wicket:wicket-core is a Java web application framework that takes simplicity, separation of concerns and ease of development to a whole new level. Wicket pages can be mocked up, previewed and later revised using standard WYSIWYG HTML design tools. Dynamic content processing an...

be.personify.iam:personify-frontend (>=1.5.1.release, <=1.5.8.release), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-context (>=4.0.0-m1, <=5.0.0) +368 more potentially affected by CVE-2026-76983 via org.apache.wicket:wicket-core (>=10.0.0-m1, <=10.10.0)

org.apache.wicket:wicket-core MAVEN version =10.0.0-m1, =1.5.1.release, =4.0.0-m1, =4.0.0-m1, =5.0.0 - com.googlecode.wicket-jquery-ui:wicket-jquery-ui 10.0.0-m1 - com.googlecode.wicket-jquery-ui:wicket-jquery-ui-calendar 10.0.0-m1 - com.googlecode.wicket-jquery-ui:wicket-jquery-ui-core 10.0.0-m1...

Cross-site Scripting (XSS)

Overview org.apache.wicket:wicket-core is a Java web application framework that takes simplicity, separation of concerns and ease of development to a whole new level. Wicket pages can be mocked up, previewed and later revised using standard WYSIWYG HTML design tools. Dynamic content processing an...