CVE WATCH / VULNERABILITY DETAIL
CVE-2026-95863
UNKNOWNCVSS 0NVD feed
Published 1 November 2026 · tracked since 1 November 2026
Description
Improper neutralization of input during web page generation in Apache Wicket. Apache Wicket generates JavaScript that refers to the elements it renders, and writes into that JavaScript two values it derives itself: a component's markup id, and the input name of a form component, which is built from
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog