QwikSec

Security Database

CVE

CWE

Training

CVE-2026-42509

Published: May 6, 2026

Modified: May 7, 2026

PUBLISHED

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket. This issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0. Users are recommended to upgrade to version 10.9.0, which fixes the issue.

Vendor	Product	Versions
Apache Software Foundation	Apache Wicket	affected `8.0.0 - <= 8.17.0` affected `9.0.0 - <= 9.22.0` affected `10.0.0 - <= 10.8.0`

Weaknesses (CWE)

References

https://lists.apache.org/thread/52nrq4tt07gxz4r6sj5gyocz5s6bprjp

vendor-advisory

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.