Threats Tagged 'cve-2026-76984'
View all threats tagged with 'cve-2026-76984'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'cve-2026-76984'
Click on any threat for detailed analysis and mitigation recommendations
0 Apache Wicket versions 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0 suffer from improper neutralization of input during web page generation. Specifically, the MetaDataHeaderItem component escapes attribute names but only replaces double quotes in attribute values with a backslash-escaped quote, which is ineffective in HTML. This allows an attacker to inject double quotes that prematurely end attribute values, potentially leading to injection of additional attributes in generated <meta> and <link> tags. The vulnerability is fixed in versions 8.19.0, 9.24.0, and 10.11.0. Join the discussion | GCVE Database | 08/31/2026, 12:30:25 UTC Added: 08/31/2026, 15:42:23 UTC |
CVE-2026-76984 is a cross-site scripting (XSS) vulnerability in Apache Wicket affecting versions from 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0. The issue arises from improper escaping of attribute values in meta and link header tags, allowing injection of malicious content if an attacker can control attribute values containing double quotes. The vulnerability is fixed in versions 8.19.0, 9.24.0, and 10.11.0. Join the discussion | CVE Database V5 | 08/31/2026, 11:56:15 UTC Added: 08/31/2026, 12:07:54 UTC |
Showing 1 to 2 of 2 results