CVE WATCH / VULNERABILITY DETAIL
CVE-2026-111089
UNKNOWNCVSS 0NVD feed
Published 1 November 2026 · tracked since 1 November 2026
Description
Apache Wicket reads texts from the application's resource bundles — a localized label, a css class name — and writes some of them into the JavaScript and the markup it generates for a component. Those texts are placed inside single-quoted JavaScript string literals and inside quoted attribute values
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog