CVE-2026-66391CWE-330CWE-693

CVE-2026-66391

Medium · published July 27, 2026

CVSS v3.1

6.5

EPSS

Percentile

49.9

In the wild

Unconfirmed

What it is

Use of Insufficiently Random Values, Protection Mechanism Failure vulnerability in Apache Wicket.

This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0.

Users are recommended to upgrade to version 10.10.0, which fixes the issue.

The record

Technical detail

CVSS v3.1: 6.5 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00637 · 49.9th percentile
Weaknesses: CWE-330 · Use of Insufficiently Random Values; CWE-693 · Protection Mechanism Failure
Published: 2026-07-27T21:16Z

Affected products (2)

Product	Versions	Fixed in
apache/wicket	≥ 9.0.0, ≤ 9.23.0	—
apache/wicket	≥ 10.0.0, < 10.10.0	10.10.0

References (2)

EPSS history

Timeline