{"metadata": {"vulnerability": "CVE-2026-95863", "count": 12, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 5}}, "data": [{"timestamp": "2026-09-22T16:47:16.652Z", "date_only": false, "value": "2026-09-22T16:47:16.652Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-95863", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-01T15:17:30Z", "date_only": false, "value": "2026-11-01T15:17:30.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-95863", "record": "CVE-2026-95863", "field": "creation_timestamp", "uuid": "07220c9e-8f79-4fa4-a1a4-e5be9a857f20", "url": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-95863"}, {"timestamp": "2026-11-01T22:30:47.259Z", "date_only": false, "value": "2026-11-01T22:30:47.259Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-95863", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-01T22:30:47.259Z", "date_only": false, "value": "2026-11-01T22:30:47.259Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-95863", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-01T22:30:47.259Z", "date_only": false, "value": "2026-11-01T22:30:47.259Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / apache", "record": "CVE-2026-95863", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-01T22:35:06.273Z", "date_only": false, "value": "2026-11-01T22:35:06.273106Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117543567705648911", "record": "CVE-2026-95863", "field": "creation_timestamp", "uuid": "8a9c6cdb-1dd3-4f4d-ae96-ce929a13e0fb", "content": "CVE-2026-95863 Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markup Improper neutralization of input during web page generation in Apache Wicket.\nApache Wicket generates JavaScript that refers to the elements it renders, andwrites into that JavaScript two values it derives itself: a component's markupid, and the input name of a form component, which is built from component ids.Both are placed inside single-quoted JavaScript string literals without beingescaped for that context, so a value containing a single quote or a backslashends the literal, and what follows is parsed as script and runs in theapplication's origin when the page loads.\nA markup id is the value passed to org.apache.wicket.Component#setMarkupId(String),or the id attribute written in the component's markup, or an id Wicketgenerates, in that order. The first two are supplied by the application in anHTML context, where both characters are legal and where Wicket escapes themcorrectly when it writes the same value into the id attribute of the element; agenerated id cannot contain either. An input name is derived from the ids of thecomponents between the form and the form component, and a component id wasrejected only for ':' and '~'.\nIn org.apache.wicket:wicket-core on 9.x and 10.x,org.apache.wicket.markup.head.OnEventHeaderItem#forMarkupId(String, String,CharSequence) quotes the id it is given into a Wicket.Event.add call, andcomponents in both wicket-core and wicket-extensions reach it through#forComponent(Component, String, CharSequence). On every affected version,org.apache.wicket.markup.html.form.Form writes its markup id and the id of itshidden-fields container into such literals,org.apache.wicket.markup.html.form.FormComponentUpdatingBehavior writes an inputname, and org.apache.wicket.markup.html.form.upload.MultiFileUploadField writestwo markup ids and an input name. On 8.x, Form also writes an input name into theaction of a submitting link, and on 8.x and 9.x Form#appendDefaultButtonFieldwrites an input name into a name attribute with no escaping at all, so a valuecontaining a double quote escapes the attribute into markup.\norg.apache.wicket:wicket-extensions is affected in its own right and not onlythrough wicket-core: AjaxEditableLabel, AjaxIndicatorAppender,AjaxDisableComponentListener, UploadProgressBar, KittenCaptchaPanel, Palette,FilterForm and, on 9.x and 10.x, TrapFocusBehavior and AjaxListPanel each buildtheir own JavaScript containing a markup id.\nAn application is affected where a markup id or a component id carries one ofthose characters. Wicket does not put one there itself, so the value comes fromthe application: an id set on a component, an id attribute in a template, or acomponent id derived from data. None of those is a JavaScript context from theapplication's point of view.\nThe Content-Security-Policy that Apache Wicket 9.x and 10.x send by default doesnot prevent this. The generated script is written into a script element carryingthe per-response nonce, so the injected code is part of a script the policyadmits.\nThe fixed versions check an id where it enters instead of escaping each place itis written. A component id and a markup id may no longer contain a quote, abackquote, a backslash, braces, angle brackets, a semicolon, an ampersand or acontrol character, and a markup id may not contain parentheses or squarebrackets either; a component constructed with such an id, or given such a markupid, fails with an exception.\nThis issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through9.24.0, from 10.0.0 through 10.11.0. Users of Apache Wicket 7.x or older, whichare no longer supported, should upgrade to a supported version. Users arerecommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.\nhttps://www.cve.org/CVERecord?id=CVE-2026-95863https://lists.apache.org/thread.html/5wg754b873tlnsc268myrwcoy9lt046v#apache #ApacheSoftwareFoundation #ApacheWicket#CVE_2026_95863#bot", "url": "https://infosec.exchange/users/cve/statuses/117543567705648911"}, {"timestamp": "2026-11-01T23:17:30Z", "date_only": false, "value": "2026-11-01T23:17:30Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-F4X7-9W8X-8X82", "record": "GHSA-F4X7-9W8X-8X82", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-01T23:17:30.943Z", "date_only": false, "value": "2026-11-01T23:17:30.943", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-95863", "record": "FKIE_CVE-2026-95863", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-01T23:43:19.507Z", "date_only": false, "value": "2026-11-01T23:43:19.507972Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/6hwpcxffkmbyf", "record": "CVE-2026-95863", "field": "creation_timestamp", "uuid": "a4374216-ac3a-40fc-88a6-b060a1e8a1c8", "content": "CVE-2026-95863 - Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markup\nCVE ID : CVE-2026-95863\n \n Published : Nov. 1, 2026, 10:30 p.m. | 33\u00a0minutes ago\n \n Description : Improper neutralization of input during web page generat...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/6hwpcxffkmbyf"}, {"timestamp": "2026-11-02T00:30:28Z", "date_only": false, "value": "2026-11-02T00:30:28Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-F4X7-9W8X-8X82", "record": "GHSA-F4X7-9W8X-8X82", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-02T00:30:28Z", "date_only": false, "value": "2026-11-02T00:30:28Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-F4X7-9W8X-8X82", "record": "GHSA-F4X7-9W8X-8X82", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-02T16:13:27.570Z", "date_only": false, "value": "2026-11-02T16:13:27.570", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-95863", "record": "FKIE_CVE-2026-95863", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-06T03:11:15.187Z", "anchors": {"origin": {"timestamp": "2026-11-01T22:30:47.259Z", "date_only": false, "value": "2026-11-01T22:30:47.259Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-95863", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-01T22:30:47.259Z", "date_only": false, "value": "2026-11-01T22:30:47.259Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-95863", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 362427.928453, "hours": 100.67442457027776, "days": 4.1947676904282405, "min_seconds": 362427.928453, "max_seconds": 362427.928453, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-01T22:30:47.259Z", "date_only": false, "value": "2026-11-01T22:30:47.259Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-95863", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-06T03:11:15.187Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}