CVE-2026-82956 | Apache Wicket up to 8.19.0/9.24.0/10.11.0 AjaxNewWindowNotifyingBehavior windowName neutralization

November 2, 2026 Yanac

A vulnerability was found in Apache Wicket up to 8.19.0/9.24.0/10.11.0. It has been rated as critical. Affected is an unknown function of the component AjaxNewWindowNotifyingBehavior. Performing a manipulation of the argument windowName results in improper neutralization.

This vulnerability is identified as CVE-2026-82956. The attack can be initiated remotely. There is not any exploit available.

Upgrading the affected component is advised.VulDB Recent EntriesRead More