Wagtail vulnerabilities

Products

• Wagtail 26

Newest

• wagtail Wagtail: Improper restriction handling on Pages admin API CVE-2026-55468 Fix available 4.3 MediumAugust 20, 2026
• torchbox wagtail Wagtail: Reflected XSS in dynamic image URL generator view CVE-2026-54263 Fix available 7.3 HighJuly 1, 2026
• torchbox wagtail Wagtail: Pages translations can be created without page permissions when using simple_translation CVE-2026-54262 Fix available 4.3 MediumJuly 1, 2026
• torchbox wagtail Wagtail: Improper permission handling in image preview CVE-2026-54261 Fix available 6.5 MediumJuly 1, 2026
• torchbox wagtail Wagtail: Improper restriction handling on Documents and Images chosen endpoints CVE-2026-54259 Fix available 4.3 MediumJuly 1, 2026
• torchbox wagtail Wagtail: Denial of service via unbounded filter specs in the image preview CVE-2026-54260 Fix available 4.3 MediumJuly 1, 2026
• torchbox wagtail Wagtail: Improper permission handling when copying pages CVE-2026-44200 Fix available 6.5 MediumMay 8, 2026
• torchbox wagtail Wagtail: Improper restriction handling on Documents and Images API CVE-2026-44201 Fix available 5.3 MediumMay 8, 2026
• torchbox wagtail Wagtail: Improper permission handling when deleting form submissions CVE-2026-44199 Fix available 6.5 MediumMay 8, 2026
• torchbox wagtail Wagtail: Improper permission handling when viewing page history CVE-2026-44198 Fix available 4.3 MediumMay 8, 2026
• torchbox wagtail Wagtail: Improper permission handling when comparing revisions CVE-2026-44197 Fix available 6.5 MediumMay 8, 2026
• torchbox wagtail Wagtail: Improper escaping of HTML (Cross-site Scripting) in simple_translation admin interface CVE-2026-28223 Fix available 6.1 MediumMarch 3, 2026
• torchbox wagtail Wagtail: Improper escaping of HTML (Cross-site Scripting) on TableBlock class attributes CVE-2026-28222 Fix available 6.1 MediumMarch 3, 2026
• torchbox wagtail Wagtail has improper permission handling on admin preview endpoints CVE-2026-25517 Fix available 5.1 MediumFebruary 3, 2026
• torchbox wagtail Wagtail regular expression denial-of-service via search query parsing CVE-2024-39317 Fix available 6.5 MediumJuly 11, 2024
• wagtail Improper Handling of Insufficient Permissions in Wagtail CVE-2024-35228 Fix available 5.5 MediumMay 30, 2024
• wagtail Permission check bypass when editing a model with per-field restrictions in wagtail CVE-2024-32882 Fix available 2.7 LowMay 1, 2024
• torchbox wagtail Disclosure of user names via admin bulk action views in wagtail CVE-2023-45809 Fix available 2.7 LowOctober 19, 2023
• torchbox wagtail Wagtail vulnerable to denial-of-service via memory exhaustion when uploading large files CVE-2023-28837 Fix available 4.9 MediumApril 3, 2023
• torchbox wagtail Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views CVE-2023-28836 Fix available 6.4 MediumApril 3, 2023
• torchbox wagtail Comment reply notifications sent to incorrect users in wagtail CVE-2022-21683 Fix available 3.5 LowJanuary 18, 2022
• torchbox wagtail Improper escaping of HTML ('Cross-site Scripting') in Wagtail StreamField blocks CVE-2021-32681 Fix available 5.4 MediumJune 17, 2021
• torchbox wagtail Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fields CVE-2021-29434 Fix available 6.1 MediumApril 19, 2021
• torchbox wagtail Cross-Site Scripting in Wagtail CVE-2020-15118 Fix available 5.7 MediumJuly 20, 2020
• torchbox wagtail Potential Observable Timing Discrepancy in Wagtail CVE-2020-11037 Fix available 6.1 MediumApril 30, 2020
• torchbox wagtail Possible XSS attack in Wagtail CVE-2020-11001 Fix available 5.8 MediumApril 14, 2020