Apache Wicket: 19 CVEs fixed in 8.20.0, 9.25.0 and 10.12.0

Summary by Cyber Security News1 Nov 2026, 23:09 CET

About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/463

Posted by Emond Papegaaij on Nov 01 On 1 November the Apache Wicket PMC published 19 security advisories. All of the issues are fixed in Apache Wicket 8.20.0, 9.25.0 and 10.12.0, for the release lines each one affects, and we recommend upgrading. 8.20.0 and 9.25.0 are the final releases of the 8.x and 9.x lines, which have now reached end of life, so if you are on 8.x or 9.x, please plan your move to Wicket 10 (LTS) or Wicket 11.

Read the full article at oss-security →

Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

Google::Auth for Perl (2 CVEs)

CVE-2026-13575: HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI

Alpine Linux rebuilds GitLab after attempted RCE attack

Week in review: Binance hit by $6.3 billion theft, impact of Brotli vulnerability

CVE-2026-115946: XS::ibbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder

CVE-2026-98432: init_on_free=1 as an additional interim mitigation