Vulnerabilities

TI-2026-40025 CVE-2026-55468 · GHSA-3vrh-m9w7-v94f

Wagtail: Improper restriction handling on Pages admin API

LOW 20

Wagtail is an open source content management system built on Django.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00342 Published 2026-08-24 Fixed in 7.0.9, 7.3.4 +2 CWE-280

TI-2026-39163 CVE-2026-54263 · GHSA-23m2-mghx-vqmf

Wagtail: Reflected XSS in dynamic image URL generator view

LOW 34

Wagtail is an open source content management system built on Django.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00361 Published 2026-07-01 Fixed in 7.0.8, 7.3.3 +1 CWE-79

TI-2026-39162 CVE-2026-54262 · GHSA-8634-mr4j-r72c

Wagtail: Pages translations can be created without page permissions when using simple_translation

LOW 20

Wagtail is an open source content management system built on Django.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0027 Published 2026-07-01 Fixed in 7.0.8, 7.3.3 +1 CWE-280

TI-2026-39161 CVE-2026-54261 · GHSA-r6p4-grq7-xm4m

Wagtail: Improper permission handling in image preview

LOW 29

Wagtail is an open source content management system built on Django.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0034 Published 2026-07-01 Fixed in 7.0.8, 7.3.3 +1 CWE-280

TI-2026-39159 CVE-2026-54259 · GHSA-h54r-xq46-qwqm

Wagtail: Improper restriction handling on Documents and Images chosen endpoints

LOW 20

Wagtail is an open source content management system built on Django.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0027 Published 2026-07-01 Fixed in 7.0.8, 7.3.3 +1 CWE-280

TI-2026-39160 CVE-2026-54260 · GHSA-f2p5-j6fg-5cxf

Wagtail: Denial of service via unbounded filter specs in the image preview

LOW 20

Wagtail is an open source content management system built on Django.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00373 Published 2026-07-01 Fixed in 7.0.8, 7.3.3 +1 CWE-400

TI-2026-32180 CVE-2026-44201 · GHSA-p5gm-92h4-6pv6

Wagtail: Improper restriction handling on Documents and Images API

LOW 30

Wagtail is an open source content management system built on Django.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00256 Published 2026-05-11 Fixed in 7.0.7, 7.3.2 CWE-280

TI-2026-32179 CVE-2026-44200 · GHSA-67rv-mg8q-5pf3

Wagtail: Improper permission handling when copying pages

LOW 28

Wagtail is an open source content management system built on Django.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00201 Published 2026-05-11 Fixed in 7.0.7, 7.3.2 CWE-280

TI-2026-32178 CVE-2026-44199 · GHSA-pwm3-7fv4-g6xx

Wagtail: Improper permission handling when deleting form submissions

LOW 28

Wagtail is an open source content management system built on Django.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00174 Published 2026-05-11 Fixed in 7.0.7, 7.3.2 CWE-280

TI-2026-32177 CVE-2026-44198 · GHSA-c4mr-889m-vgf6

Wagtail: Improper permission handling when viewing page history

LOW 19

Wagtail is an open source content management system built on Django.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00162 Published 2026-05-11 Fixed in 7.0.7, 7.3.2 CWE-280

TI-2026-32176 CVE-2026-44197 · GHSA-c6wj-9vcj-75pj

Wagtail: Improper permission handling when comparing revisions

LOW 28

Wagtail is an open source content management system built on Django.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00204 Published 2026-05-11 Fixed in 7.0.7, 7.3.2 CWE-280

TI-2026-22557 CVE-2026-28222 · GHSA-p5cm-246w-84jm

Wagtail: Improper escaping of HTML (Cross-site Scripting) on TableBlock class attributes

LOW 30

Wagtail is an open source content management system built on Django.

CVSS 3.1MEDIUM 6.1 Network High privileges User interaction EPSS 0.00503 Published 2026-03-05 Fixed in 6.3.8, 7.0.6 +2 CWE-79

TI-2026-22558 CVE-2026-28223 · GHSA-p4v8-rw59-93cq

Wagtail: Improper escaping of HTML (Cross-site Scripting) in simple_translation admin interface

LOW 30

Wagtail is an open source content management system built on Django.

CVSS 3.1MEDIUM 6.1 Network High privileges User interaction EPSS 0.00535 Published 2026-03-05 Fixed in 6.3.8, 7.0.6 +2 CWE-79

TI-2026-20626 CVE-2026-25517 · GHSA-4qvv-g3vr-m348

Wagtail has improper permission handling on admin preview endpoints

LOW 23

Wagtail is an open source content management system built on Django.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00384 Published 2026-02-04 Fixed in 6.3.6, 7.0.4 +3 CWE-862

TI-2024-26273 CVE-2024-39317 · GHSA-jmp3-39vp-fwg8

Wagtail regular expression denial-of-service via search query parsing

LOW 30

Wagtail is an open source content management system built on Django.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0061 Published 2024-07-11 Fixed in 5.2.6, 6.0.6 +1 CWE-1333

TI-2024-23298 CVE-2024-35228 · GHSA-xxfm-vmcf-g33f

Improper Handling of Insufficient Permissions in Wagtail

LOW 25

Wagtail is an open source content management system built on Django.

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00332 Published 2024-05-30 Fixed in 6.0.5, 6.1.2 CWE-280

TI-2024-21754 CVE-2024-32882 · GHSA-w2v8-php4-p8hc

Permission check bypass when editing a model with per-field restrictions in wagtail

LOW 14

Wagtail is an open source content management system built on Django.

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00483 Published 2024-05-02 Fixed in 6.0.3 CWE-280

TI-2023-24570 CVE-2023-45809 · GHSA-fc75-58r8-rm3h

Disclosure of user names via admin bulk action views in wagtail

LOW 14

Wagtail is an open source content management system built on Django.

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00555 Published 2023-10-19 Fixed in 4.1.9, 5.0.5 +1 CWE-200

TI-2023-13343 CVE-2023-28837 · GHSA-33pv-vcgh-jfg9

Wagtail vulnerable to denial-of-service via memory exhaustion when uploading large files

LOW 25

Wagtail is an open source content management system built on Django.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.0107 Published 2023-04-03 Fixed in 4.1.4, 4.2.2 CWE-400

TI-2023-13342 CVE-2023-28836 · GHSA-5286-f2rf-35c2

Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views

LOW 32

Wagtail is an open source content management system built on Django.

CVSS 3.1MEDIUM 6.4 Network High privileges User interaction EPSS 0.00772 Published 2023-04-03 Fixed in 4.1.1, 4.2.2 +1 CWE-79

TI-2022-06059 CVE-2022-21683 · GHSA-xqxm-2rpm-3889

Comment reply notifications sent to incorrect users in wagtail

LOW 22

Wagtail is a Django based content management system focused on flexibility and user experience.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0097 Published 2022-01-18 Fixed in 2.15.2 CWE-200

TI-2021-12349 CVE-2021-32681 · GHSA-xfrw-hxr5-ghqf

Improper escaping of HTML ('Cross-site Scripting') in Wagtail StreamField blocks

LOW 27

Wagtail is an open source content management system built on Django.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01109 Published 2021-06-17 Fixed in 2.11.8, 2.12.5 +1 CWE-79

TI-2021-10147 CVE-2021-29434 · GHSA-wq5h-f9p5-q7fx

Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fields

LOW 28

Wagtail is a Django content management system.

CVSS 3.1MEDIUM 6.1 Network High privileges User interaction EPSS 0.00626 Published 2021-04-19 Fixed in 2.11.7, 2.12.4 CWE-79

TI-2020-11892 CVE-2020-15118 · GHSA-2473-9hgq-j7xw

Cross-Site Scripting in Wagtail

LOW 28

In Wagtail before versions 2.7.4 and 2.9.3, when a form page type is made available to Wagtail editors through the `wagtail.contrib.forms` app, and the page template is built using Django's standard form rendering helper…

CVSS 3.1MEDIUM 5.7 Network High privileges User interaction EPSS 0.01101 Published 2020-07-20 Fixed in 2.7.4, 2.9.3 CWE-79

TI-2020-08911 CVE-2020-11037 · GHSA-jjjr-3jcw-f8v6

Potential Observable Timing Discrepancy in Wagtail

LOW 27

In Wagtail before versions 2.7.3 and 2.8.2, a potential timing attack exists on pages or documents that have been protected with a shared password through Wagtail's "Privacy" controls.

CVSS 3.1MEDIUM 6.1 Local High privileges No interaction EPSS 0.0025 Published 2020-04-30 Fixed in 2.7.3, 2.8.2 +1 CWE-208

Vulnerabilities

Filters