Loading story…
Apache disclosed CVE-2026-66390, an important-severity cross-site scripting vulnerability in Apache Wicket caused by improper neutralization of input during web page generation. The flaw allows crafted Link URL strings to break out of an intended JavaScript sequence, creating a path for script injection in affected web applications built on the framework.
The issue affects Apache Wicket versions 9.0.0 through 9.23.0 and 10.0.0 through 10.9.0. A security notice published on the oss-sec mailing list advised users to remediate by upgrading to Apache Wicket 10.10.0, making patch validation and exposure review a priority for organizations running Wicket-based applications.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A security notice disclosed CVE-2026-66390, describing an improper neutralization of input during web page generation that can enable cross-site scripting. The notice said the issue affects Apache Wicket versions 9.0.0 through 9.23.0 and 10.0.0 through 10.9.0.
Apache Wicket users were advised to upgrade to version 10.10.0 to remediate CVE-2026-66390, an important-severity cross-site scripting flaw involving crafted Link URL strings breaking out of a JavaScript sequence.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache disclosed **CVE-2026-59083**, a vulnerability in Tomcat's `RewriteValve` caused by incorrect URL decoding of hex-encoded characters that can let attackers bypass security controls in some configurations. The issue is classified as **CWE-177** and was described as low severity by Apache, though the CVE record notes network attackability with low attack complexity, no privileges required, and no user interaction. Apache said the flaw affects supported Tomcat branches **11.0.0-M1 through 11.0.23**, **10.1.0-M1 through 10.1.56**, and **9.0.0.M1 through 9.0.119**, with reports also listing **8.5.0 through 8.5.100** as affected. Apache and downstream advisories urged users to upgrade to fixed releases **11.0.24**, **10.1.57**, or **9.0.120**, while warning that older unsupported versions may also be vulnerable; versions before **8.0.0** were noted as unaffected in the oss-security disclosure. The vulnerability was published through Apache security pages, the Apache mailing list, and `oss-security`, with the CVE entry updated to include affected-version details, a CVSS v3.1 vector, and a CISA SSVC assessment.
Aug 28, 2026
Apache disclosed **CVE-2026-50229**, a basic cross-site scripting vulnerability in the Number Guess example application shipped with Apache Tomcat. The issue is classified as `CWE-80`, improper neutralization of script-related HTML tags, allowing attacker-supplied script content to be rendered in a victim’s browser when the vulnerable example is exposed. Affected supported release lines include Tomcat versions through 11.0.22, 10.1.55, 9.0.118, 8.5.100, and 7.0.109. Organizations using the example application should remove or restrict it where unnecessary and upgrade to Tomcat 11.0.23, 10.1.56, or 9.0.119; end-of-support releases may also be affected.
Aug 28, 2026
Apache disclosed **CVE-2026-45249**, an important-severity cross-site scripting flaw in Apache ECharts that affects versions prior to **6.1.0**. The vulnerability is in the **Lines** series tooltip rendering path and is triggered when tooltips are enabled, no custom `tooltip.formatter` is defined, and `series.data[i].name` contains raw HTML that is inserted into the page through an `innerHTML` sink instead of being escaped. Successful exploitation can lead to arbitrary JavaScript execution in a victim’s browser, creating risks including session token theft and account hijacking. Apache said the issue breaks the expected behavior of built-in tooltip formatting and has remediated it in **Apache ECharts 6.1.0**; users relying on Lines series tooltips are being urged to upgrade. The vulnerability was credited to **Lakshmikanthan K** and disclosed by **Zhongxiang Wang** on the oss-sec mailing list.
Jun 29, 2026