CVEs we hold for Wagtail
Records whose assigning authority named Wagtail as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-55468Wagtail: Improper restriction handling on Pages admin APIwagtail CVE-2026-54263Wagtail: Reflected XSS in dynamic image URL generator viewwagtail CVE-2026-54262Wagtail: Pages translations can be created without page permissions when using simple_translationwagtail CVE-2026-54261Wagtail: Improper permission handling in image previewwagtail CVE-2026-54260Wagtail: Denial of service via unbounded filter specs in the image previewwagtail CVE-2026-54259Wagtail: Improper restriction handling on Documents and Images chosen endpointswagtail CVE-2026-44201Wagtail: Improper restriction handling on Documents and Images APIwagtail CVE-2026-44200Wagtail: Improper permission handling when copying pageswagtail CVE-2026-44199Wagtail: Improper permission handling when deleting form submissionswagtail CVE-2026-44198Wagtail: Improper permission handling when viewing page historywagtail CVE-2026-44197Wagtail: Improper permission handling when comparing revisionswagtail CVE-2026-28223Wagtail: Improper escaping of HTML (Cross-site Scripting) in simple_translation admin interfacewagtail CVE-2026-28222Wagtail: Improper escaping of HTML (Cross-site Scripting) on TableBlock class attributeswagtail CVE-2026-25517Wagtail has improper permission handling on admin preview endpointswagtail CVE-2024-39317Wagtail regular expression denial-of-service via search query parsingwagtail CVE-2024-35228Improper Handling of Insufficient Permissions in Wagtailwagtail CVE-2024-32882Permission check bypass when editing a model with per-field restrictions in wagtailwagtail CVE-2023-45809Disclosure of user names via admin bulk action views in wagtailwagtail CVE-2023-28837Wagtail vulnerable to denial-of-service via memory exhaustion when uploading large fileswagtail CVE-2023-28836Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin viewswagtail CVE-2022-21683Comment reply notifications sent to incorrect users in wagtailwagtail CVE-2021-32681Improper escaping of HTML ('Cross-site Scripting') in Wagtail StreamField blockswagtail CVE-2021-29434Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fieldswagtail CVE-2020-11037Potential Observable Timing Discrepancy in WagtailWagtail 26 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.