CVE WATCH / VULNERABILITY DETAIL
CVE-2026-87718
UNKNOWNCVSS 0NVD feed
Published 1 November 2026 · tracked since 1 November 2026
Description
Apache Wicket 10.10.0, 10.11.0 and 9.24.0 do not set the Content-Security-Policy headers on a page whose render request handler is wrapped in more than one IRequestHandlerDelegate. The framework unwraps only a single delegate level when deciding whether a request renders a page, so with a deeper cha
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog