CVEs published in November 2026
1,109 tracked CVEs from 13 vendors had their first vendor advisory published in November 2026: 43 critical, 709 high, 7 in CISA KEV. Newest first.
723 more from this month are covered only by Red Hat's per-package records, listed on the Red Hat vendor page.
- Added
CVE-2026-82956High
Apache Wicket: XSS in AjaxNewWindowNotifyingBehavior via the client-supplied window name
Apache · 1 advisory - Added
Apache Wicket: A cross-origin listener invocation stopped by a login wall is replayed after the user signs in
Apache · 1 advisory - Added
CVE-2026-82840High
Apache Wicket: The session id is renewed only on the first sign in, not on re-authentication
Apache · 1 advisory - Added
CVE-2026-82705Medium
Apache Wicket: The configured authorization strategy is not applied to an IResource embedded in a component
Apache · 1 advisory - Added
CVE-2026-82704Medium
Apache Wicket: A listener is invoked on a page instance the request itself created and never configured
Apache · 1 advisory - Added
Apache Wicket: WebSocket messages are processed against an HTTP session snapshot that survives invalidation
Apache · 1 advisory - Added
Apache Wicket: WebSocketBehavior delivers client messages to a component the client may not invoke
Apache · 1 advisory - Added
CVE-2026-82557Medium
Apache Wicket: A disabled or invisible form submitting component is still invoked on a plain form submission
Apache · 1 advisory - Added
CVE-2026-82115Medium
Apache Wicket: The configured authorization strategy is not applied to a shared WebSocketResource
Apache · 1 advisory