Apache product
Wicket
Tracked since 2 Nov · latest article 2 Nov · RSS · API
None open
of 0 in the full CISA catalogue · all time
EPSS top 5%, not in KEV
usual rate
Exploited, by due date
No Wicket CVE is in the CISA KEV catalogue.
Patch cadence and exploit odds
How often CISA adds Wicket CVEs, how many have a fix, and where their exploit odds sit.
Added to CISA KEV per quarter
CISA has not added a Wicket CVE to KEV.
Fix listed
6 of 6 CVEs in coverage
Every CVE in coverage has a fix recorded.
EPSS percentile of each CVE
No EPSS scores are recorded for these CVEs.
Coverage1 article · all time
The latest article naming Wicket, in the shared story grammar.
1 article from 1 outlet since 2 Nov. Still developing; the latest report was 4 hours ago.
- Mon 2 Nov, 03:30 UTC. SecurityOnline, first report. Apache Wicket fixes 19 flaws across three supported releases.
- CVE not in KEV
- No CVE
- Larger: an outlet’s first report
- Coverage over time
Show all 1 articles as a listHide the list
- Mon 2 NovDay 01
- Apache Wicket fixes 19 flaws across three supported releases03:30 · SecurityOnline · First report
All CVEs in coverage6
Exploited first, then by EPSS
Apache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor tag
7.4High1 articleApache Wicket: XSS in AjaxNewWindowNotifyingBehavior via the client-supplied window name
7.6High1 articleApache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markup
7.6High1 articleApache Wicket: XSS via a resource bundle text written unescaped into generated JavaScript and markup
7.6High1 articleApache Wicket: FileUploadToResourceField accepts a client-asserted upload result and allocates the size it names
8.3High1 articleApache Wicket: Configured upload limits are not enforced by the standalone file upload resource
8.3High1 article