{"kind": "product", "path": "vulns/pypi/wagtail", "name": "wagtail", "product": "wagtail", "ecosystem": "PyPI", "items": [{"id": "CVE-2026-55468", "noindex": false, "published": "2026-08-24T20:37:36.460Z", "modified": "2026-08-25T16:32:43.104Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00342, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-55468", "title": "Wagtail: Improper restriction handling on Pages admin API", "description": "Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in api_fields without sufficient access control, allowing a user with Wagtail admin access to retrieve restricted draft and live page content. This issue is fixed in versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.", "references": ["https://github.com/wagtail/wagtail/security/advisories/GHSA-3vrh-m9w7-v94f", "https://github.com/wagtail/wagtail/commit/5608cfb714a130412f862beab53c78de02b79975", "https://github.com/wagtail/wagtail/commit/aef935530d5289406ca325b42747af15f3b28ac4"], "fixes": ["7.0.9", "7.3.4", "7.4.3", "8.0rc2"], "products": [{"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}]}, {"id": "GHSA-jm5p-837g-rv8g", "noindex": false, "published": "2026-08-20T18:45:27Z", "modified": "2026-08-20T19:00:07.496785371Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/ghsa-jm5p-837g-rv8g", "title": "Wagtail: Improper restriction handling on Page translation API endpoint", "description": "### Impact\nA CMS user with the \"submit translations\" permission, could use the Admin API's \"copy for translation\" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents.\n\n### Patches\nPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.\n\n### Workarounds\nN/A\n\n### Acknowledgements\nMany thanks to tinyb0y for reporting this issue.\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n* Visit Wagtail's [support channels](https://docs.wagtail.org/en/stable/support.html)\n* Email us at [security@wagtail.org](mailto:security@wagtail.org) (view ", "references": ["https://github.com/wagtail/wagtail/security/advisories/GHSA-jm5p-837g-rv8g", "https://github.com/wagtail/wagtail", "https://osv.dev/vulnerability/GHSA-jm5p-837g-rv8g"], "fixes": ["7.0.9", "7.3.4", "7.4.3", "8.0rc2"], "products": [{"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}]}, {"id": "GHSA-x5cx-w6p2-mxf2", "noindex": false, "published": "2026-08-20T18:45:23Z", "modified": "2026-08-20T19:00:09.852018288Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/ghsa-x5cx-w6p2-mxf2", "title": "Wagtail: Improper permission handling when copying snippets", "description": "### Impact\nA CMS user with \"add\" permission over a snippet model, but not \"change\" or \"view\" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents.\n\n### Patches\nPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.\n\n### Workarounds\nN/A\n\n### Acknowledgements\nMany thanks to tinyb0y for reporting this issue.\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n* Visit Wagtail's [support channels](https://docs.wagtail.org/en/stable/support.html)\n* Email us at [security@wagtail.org](mailto:security@wagtail.org) (view our [security pol", "references": ["https://github.com/wagtail/wagtail/security/advisories/GHSA-x5cx-w6p2-mxf2", "https://github.com/wagtail/wagtail", "https://osv.dev/vulnerability/GHSA-x5cx-w6p2-mxf2"], "fixes": ["7.0.9", "7.3.4", "7.4.3", "8.0rc2"], "products": [{"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}]}, {"id": "GHSA-c2xx-cjmh-9q8f", "noindex": false, "published": "2026-08-20T18:45:14Z", "modified": "2026-08-20T19:00:07.489126988Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/ghsa-c2xx-cjmh-9q8f", "title": "Wagtail: Improper restriction handling on descendant collections in Documents and Images API", "description": "### Impact\n\nThe Documents and Images [API V2](https://docs.wagtail.org/en/stable/advanced_topics/api/index.html) incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections.\n\n### Patches\n\nPatched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.\n\n### Workarounds\n\nSite owners using Wagtail's API can avoid the vulnerability by adding [authentication](https://docs.wagtail.org/en/stable/advanced_topics/api/v2/configuration.html#authenti", "references": ["https://github.com/wagtail/wagtail/security/advisories/GHSA-c2xx-cjmh-9q8f", "https://github.com/wagtail/wagtail", "https://osv.dev/vulnerability/GHSA-c2xx-cjmh-9q8f"], "fixes": ["7.0.9", "7.3.4", "7.4.3", "8.0rc2"], "products": [{"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}]}, {"id": "GHSA-92hv-j533-69wc", "noindex": false, "published": "2026-08-20T18:45:09Z", "modified": "2026-08-20T19:00:08.966304856Z", "cvss": 3.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "low", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/ghsa-92hv-j533-69wc", "title": "Wagtail: Identification of documents by SHA1 hash", "description": "### Impact\nBy passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to determine whether a document with a specific known hash is present in the Wagtail document library.\n\nThis vulnerability does not expose the document's contents or any metadata beyond the already known SHA1 hash, and does not expose information about any documents for which the attacker does not know the SHA1 hash.\n\n### Patches\nPatched versions have been", "references": ["https://github.com/wagtail/wagtail/security/advisories/GHSA-92hv-j533-69wc", "https://github.com/wagtail/wagtail", "https://osv.dev/vulnerability/GHSA-92hv-j533-69wc"], "fixes": ["7.0.9", "7.3.4", "7.4.3", "8.0rc2"], "products": [{"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-54263", "noindex": false, "published": "2026-07-01T21:12:30.719Z", "modified": "2026-07-06T14:41:12.073Z", "cvss": 7.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.00361, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-54263", "title": "Wagtail: Reflected XSS in dynamic image URL generator view", "description": "Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, reflected cross-site scripting (XSS) vulnerability exists on the dynamic image URL generator view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could craft a URL that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is present for all sites, even if they do not enable the dynamic image serve view. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This is", "references": ["https://github.com/wagtail/wagtail/security/advisories/GHSA-23m2-mghx-vqmf", "https://nvd.nist.gov/vuln/detail/CVE-2026-54263"], "fixes": ["7.3.3", "7.4.2"], "products": [{"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-54262", "noindex": false, "published": "2026-07-01T21:11:27.671Z", "modified": "2026-07-02T12:42:13.452Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.0027, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-54262", "title": "Wagtail: Pages translations can be created without page permissions when using simple_translation", "description": "Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, a low-level user with the \"Can submit translation\" permission can create translations for any page, including those they do not have permissions for. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.", "references": ["https://github.com/wagtail/wagtail/security/advisories/GHSA-8634-mr4j-r72c", "https://nvd.nist.gov/vuln/detail/CVE-2026-54262"], "fixes": ["7.0.8", "7.3.3", "7.4.2"], "products": [{"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-54261", "noindex": false, "published": "2026-07-01T21:10:22.800Z", "modified": "2026-07-02T14:42:46.778Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.0034, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-54261", "title": "Wagtail: Improper permission handling in image preview", "description": "Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, due to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.", "references": ["https://github.com/wagtail/wagtail/security/advisories/GHSA-r6p4-grq7-xm4m", "https://nvd.nist.gov/vuln/detail/CVE-2026-54261"], "fixes": ["7.0.8", "7.3.3", "7.4.2"], "products": [{"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-54259", "noindex": false, "published": "2026-07-01T21:09:19.800Z", "modified": "2026-07-02T15:49:19.274Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.0027, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-54259", "title": "Wagtail: Improper restriction handling on Documents and Images chosen endpoints", "description": "Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, the Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.", "references": ["https://github.com/wagtail/wagtail/security/advisories/GHSA-h54r-xq46-qwqm", "https://nvd.nist.gov/vuln/detail/CVE-2026-54259"], "fixes": ["7.0.8", "7.3.3", "7.4.2"], "products": [{"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-54260", "noindex": false, "published": "2026-07-01T21:08:24.820Z", "modified": "2026-07-02T15:54:38.571Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.00373, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-54260", "title": "Wagtail: Denial of service via unbounded filter specs in the image preview", "description": "Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, an authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been fixed in versions 7.0.8, 7.3.3, and 7.4.2.", "references": ["https://github.com/wagtail/wagtail/security/advisories/GHSA-f2p5-j6fg-5cxf", "https://nvd.nist.gov/vuln/detail/CVE-2026-54260"], "fixes": ["7.0.8", "7.3.3", "7.4.2"], "products": [{"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-44201", "noindex": false, "published": "2026-05-11T14:42:22.055Z", "modified": "2026-05-12T13:45:39.924Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00313, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-44201", "title": "Wagtail: Improper restriction handling on Documents and Images API", "description": "Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.", "references": ["https://github.com/wagtail/wagtail/security/advisories/GHSA-p5gm-92h4-6pv6", "https://nvd.nist.gov/vuln/detail/CVE-2026-44201"], "fixes": ["7.0.7", "7.3.2"], "products": [{"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-44200", "noindex": false, "published": "2026-05-11T14:41:41.807Z", "modified": "2026-05-11T19:07:11.475Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.0034, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-44200", "title": "Wagtail: Improper permission handling when copying pages", "description": "Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once coped, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.", "references": ["https://github.com/wagtail/wagtail/security/advisories/GHSA-67rv-mg8q-5pf3", "https://nvd.nist.gov/vuln/detail/CVE-2026-44200"], "fixes": ["7.0.7", "7.3.2"], "products": [{"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-44199", "noindex": false, "published": "2026-05-11T14:40:58.488Z", "modified": "2026-05-11T18:23:01.588Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "severity": "medium", "epss": 0.00299, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-44199", "title": "Wagtail: Improper permission handling when deleting form submissions", "description": "Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.", "references": ["https://github.com/wagtail/wagtail/security/advisories/GHSA-pwm3-7fv4-g6xx", "https://nvd.nist.gov/vuln/detail/CVE-2026-44199"], "fixes": ["7.0.7", "7.3.2"], "products": [{"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-44198", "noindex": false, "published": "2026-05-11T14:40:07.186Z", "modified": "2026-05-11T15:53:39.449Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.0027, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-44198", "title": "Wagtail: Improper permission handling when viewing page history", "description": "Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.", "references": ["https://github.com/wagtail/wagtail/security/advisories/GHSA-c4mr-889m-vgf6", "https://nvd.nist.gov/vuln/detail/CVE-2026-44198"], "fixes": ["7.0.7", "7.3.2"], "products": [{"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-44197", "noindex": false, "published": "2026-05-11T14:39:25.356Z", "modified": "2026-05-14T17:53:17.749Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.00346, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-44197", "title": "Wagtail: Improper permission handling when comparing revisions", "description": "Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.", "references": ["https://github.com/wagtail/wagtail/security/advisories/GHSA-c6wj-9vcj-75pj", "https://nvd.nist.gov/vuln/detail/CVE-2026-44197"], "fixes": ["7.0.7", "7.3.2"], "products": [{"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-28222", "noindex": false, "published": "2026-03-05T18:58:20.719Z", "modified": "2026-03-06T18:05:28.611Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N", "severity": "medium", "epss": 0.00626, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-28222", "title": "Wagtail: Improper escaping of HTML (Cross-site Scripting) on TableBlock class attributes", "description": "Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on rendering TableBlock blocks within a StreamField. A user with access to create or edit pages containing TableBlock StreamField blocks is able to set specially-crafted class attributes on the block which run arbitrary JavaScript code when the page is viewed. When viewed by a user with higher privileges, this could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admi", "references": ["https://github.com/wagtail/wagtail/security/advisories/GHSA-p5cm-246w-84jm", "https://github.com/wagtail/wagtail/commit/0375094bb57ce6e527005c2bb2e871dd20bca04d", "https://github.com/wagtail/wagtail/commit/4620423cb22c5253391a0f04178089c1162f6e2e"], "fixes": ["6.3.8", "7.0.6", "7.2.3", "7.3.1"], "products": [{"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-28223", "noindex": false, "published": "2026-03-05T18:56:41.835Z", "modified": "2026-03-06T10:39:42.379Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N", "severity": "medium", "epss": 0.00626, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-28223", "title": "Wagtail: Improper escaping of HTML (Cross-site Scripting) in simple_translation admin interface", "description": "Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simple_translation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the \"Translate\" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. This issue has been patched in v", "references": ["https://github.com/wagtail/wagtail/security/advisories/GHSA-p4v8-rw59-93cq", "https://github.com/wagtail/wagtail/commit/1c6f2effed68f4ccad6fbd07987e03641505f863", "https://github.com/wagtail/wagtail/commit/ba70244d376a7b1bd180ded03e827917ff410c19"], "fixes": ["6.3.8", "7.0.6", "7.2.3", "7.3.1"], "products": [{"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-25517", "noindex": false, "published": "2026-02-04T20:48:19.160Z", "modified": "2026-02-05T14:32:08.136Z", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00486, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-25517", "title": "Wagtail has improper permission handling on admin preview endpoints", "description": "Wagtail is an open source content management system built on Django. Prior to versions 6.3.6, 7.0.4, 7.1.3, 7.2.2, and 7.3, due to a missing permission check on the preview endpoints, a user with access to the Wagtail admin and knowledge of a model's fields can craft a form submission to obtain a preview rendering of any page, snippet or site setting object for which previews are enabled, consisting of any data of the user's choosing. The existing data of the object itself is not exposed, but depending on the nature of the template being rendered, this may expose other database contents that would otherwise only be accessible to users with ed", "references": ["https://github.com/wagtail/wagtail/security/advisories/GHSA-4qvv-g3vr-m348", "https://github.com/wagtail/wagtail/commit/01fd3477365a193e6a8270311defb76e890d2719", "https://github.com/wagtail/wagtail/commit/5f09b6da61e779b0e8499bdbba52bf2f7bd3241f"], "fixes": ["6.3.6", "7.0.4", "7.1.3", "7.2.2", "7.3"], "products": [{"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-39317", "noindex": false, "published": "2024-07-11T15:23:22.307Z", "modified": "2024-08-02T04:19:20.749Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00615, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-39317", "title": "Wagtail regular expression denial-of-service via search query parsing", "description": "Wagtail is an open source content management system built on Django. A bug in Wagtail's `parse_query_string` would result in it taking a long time to process suitably crafted inputs. When used to parse sufficiently long strings of characters without a space, `parse_query_string` would take an unexpectedly large amount of time to process, resulting in a denial of service. In an initial Wagtail installation, the vulnerability can be exploited by any Wagtail admin user. It cannot be exploited by end users. If your Wagtail site has a custom search implementation which uses `parse_query_string`, it may be exploitable by other users (e.g. unauthent", "references": ["https://github.com/wagtail/wagtail/security/advisories/GHSA-jmp3-39vp-fwg8", "https://github.com/wagtail/wagtail/commit/31b1e8532dfb1b70d8d37d22aff9cbde9109cdf2", "https://github.com/wagtail/wagtail/commit/3c941136f79c48446e3858df46e5b668d7f83797"], "fixes": ["5.2.6", "6.0.6", "6.1.3"], "products": [{"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}]}, {"id": "CVE-2024-35228", "noindex": false, "published": "2024-05-30T18:44:31.900Z", "modified": "2024-08-02T03:07:46.735Z", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N", "severity": "medium", "epss": 0.00332, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2024-35228", "title": "Improper Handling of Insufficient Permissions in Wagtail", "description": "Wagtail is an open source content management system built on Django. Due to an improperly applied permission check in the `wagtail.contrib.settings` module, a user with access to the Wagtail admin and knowledge of the URL of the edit view for a settings model can access and update that setting, even when they have not been granted permission over the model. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. Patched versions have been released as Wagtail 6.0.5 and 6.1.2. Wagtail releases prior to 6.0 are unaffected. Users are advised to upgrade. Site owners who are unable to upgrade to a patch", "references": ["https://github.com/wagtail/wagtail/security/advisories/GHSA-xxfm-vmcf-g33f", "https://github.com/wagtail/wagtail/commit/284f75a6f91f7ab18cc304d7d34f33b559ae37b1", "https://nvd.nist.gov/vuln/detail/CVE-2024-35228"], "fixes": ["6.0.5", "6.1.2"], "products": [{"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}, {"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}]}], "total": 30, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "wagtail", "path": "vulns/pypi/wagtail", "ecosystem": "PyPI"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": ["8.0rc1", "7.4.2", "7.4.1", "7.4", "7.3.3", "7.3.2", "7.3.1", "7.3rc1", "7.3", "7.2.3", "7.2.2", "7.2.1"], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-08-25T16:32:43.104Z", "early_advisories": [], "license": "Puedes utilizar libremente la selección de PatchFirst y nuestras aportaciones (prioridades, alertas tempranas, textos, resúmenes y agregados) para tus propios fines, incluido el uso interno de tu empresa. La reventa, la distribución comercial y la creación masiva de réplicas de esta selección o de estas aportaciones requieren un acuerdo escrito con el operador. Siempre que uses o publiques la selección o nuestras aportaciones, cita a PatchFirst (https://patchfirst.dev/vulns/) con este enlace a la página del flujo de tu región. Los registros originales de fuentes abiertas siguen sujetos a sus respectivas licencias y condiciones. Estas condiciones no limitan tus derechos sobre los datos originales, que puedes obtener directamente de esas fuentes.", "terms_url": "https://patchfirst.dev/es/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst selecciona, normaliza y combina los registros; se pueden añadir resúmenes y traducciones. Las noticias incluyen un enlace a la fuente original en cada entrada.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Las licencias de las bases originales varían; consulta el catálogo de fuentes."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Puntuaciones públicas gratuitas; se solicita atribución (FIRST EPSS, puntuaciones generadas por Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}