CVE-2026-66390mediumCWE-79

CVE-2026-66390: medium-severity vulnerability in Apache Wicket

Apache Wicket: crafted Link URL strings can break out of the JavaScript sequence

Published · Updated

Follow this CVE+ Monitor Apache Wicket

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.1epss 0.6%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0. Users are recommended to upgrade to version 10.10.0, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
Apache Software Foundation · Apache Wicket
Related CVEs — Apache Wicket

In the same product, most dangerous first.

CVE-2021-23937—DNS proxy and possible amplification attackEPSS 4.3%CVE-2014-0043—CVE-2014-0043EPSS 3.0%CVE-2024-36522CRITICALApache Wicket: Remote code execution via XSLT injectionEPSS 2.1%CVE-2024-53299MEDIUMApache Wicket: An attacker can intentionally trigger a memory leakEPSS 1.5%CVE-2026-70449MEDIUMApache Wicket: Path traversal in resource style/variation/localeEPSS 0.9%CVE-2016-6806—CVE-2016-6806EPSS 0.8%