# cve.now: Wagtail

The newest entries naming Wagtail as an affected vendor (up to 200), of 30 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-125106](https://cve.now/CVE-2026-125106.md): Wagtail: Improper restriction handling on Page translation API endpoint (CVSS 6.5)
- [CVE-2026-125105](https://cve.now/CVE-2026-125105.md): Wagtail: Identification of documents by SHA1 hash (CVSS 3.7)
- [CVE-2026-123820](https://cve.now/CVE-2026-123820.md): Wagtail: Improper restriction handling on descendant collections in Documents and Images API (CVSS 5.3)
- [CVE-2026-123819](https://cve.now/CVE-2026-123819.md): Wagtail: Improper permission handling when copying snippets (CVSS 6.5)
- [CVE-2026-55468](https://cve.now/CVE-2026-55468.md): Wagtail: Improper restriction handling on Pages admin API (CVSS 4.3)
- [CVE-2026-54263](https://cve.now/CVE-2026-54263.md): Wagtail: Reflected XSS in dynamic image URL generator view (CVSS 7.3)
- [CVE-2026-54262](https://cve.now/CVE-2026-54262.md): Wagtail: Pages translations can be created without page permissions when using simple\_translation (CVSS 4.3)
- [CVE-2026-54261](https://cve.now/CVE-2026-54261.md): Wagtail: Improper permission handling in image preview (CVSS 6.5)
- [CVE-2026-54259](https://cve.now/CVE-2026-54259.md): Wagtail: Improper restriction handling on Documents and Images chosen endpoints (CVSS 4.3)
- [CVE-2026-54260](https://cve.now/CVE-2026-54260.md): Wagtail: Denial of service via unbounded filter specs in the image preview (CVSS 4.3)
- [CVE-2026-44201](https://cve.now/CVE-2026-44201.md): Wagtail: Improper restriction handling on Documents and Images API (CVSS 5.3)
- [CVE-2026-44200](https://cve.now/CVE-2026-44200.md): Wagtail: Improper permission handling when copying pages (CVSS 6.5)
- [CVE-2026-44199](https://cve.now/CVE-2026-44199.md): Wagtail: Improper permission handling when deleting form submissions (CVSS 6.5)
- [CVE-2026-44198](https://cve.now/CVE-2026-44198.md): Wagtail: Improper permission handling when viewing page history (CVSS 4.3)
- [CVE-2026-44197](https://cve.now/CVE-2026-44197.md): Wagtail: Improper permission handling when comparing revisions (CVSS 6.5)
- [CVE-2026-28222](https://cve.now/CVE-2026-28222.md): Wagtail: Improper escaping of HTML (Cross-site Scripting) on TableBlock class attributes (CVSS 6.1)
- [CVE-2026-28223](https://cve.now/CVE-2026-28223.md): Wagtail: Improper escaping of HTML (Cross-site Scripting) in simple\_translation admin interface (CVSS 6.1)
- [CVE-2026-25517](https://cve.now/CVE-2026-25517.md): Wagtail has improper permission handling on admin preview endpoints (CVSS 5.1)
- [CVE-2024-39317](https://cve.now/CVE-2024-39317.md): Wagtail regular expression denial-of-service via search query parsing (CVSS 6.5)
- [CVE-2024-35228](https://cve.now/CVE-2024-35228.md): Improper Handling of Insufficient Permissions in Wagtail (CVSS 5.5)
- [CVE-2024-32882](https://cve.now/CVE-2024-32882.md): Permission check bypass when editing a model with per-field restrictions in wagtail (CVSS 2.7)
- [CVE-2023-45809](https://cve.now/CVE-2023-45809.md): Disclosure of user names via admin bulk action views in wagtail (CVSS 2.7)
- [CVE-2023-28837](https://cve.now/CVE-2023-28837.md): Wagtail vulnerable to denial-of-service via memory exhaustion when uploading large files (CVSS 4.9)
- [CVE-2023-28836](https://cve.now/CVE-2023-28836.md): Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views (CVSS 6.4)
- [CVE-2022-21683](https://cve.now/CVE-2022-21683.md): Comment reply notifications sent to incorrect users in wagtail (CVSS 3.5)
- [CVE-2021-32681](https://cve.now/CVE-2021-32681.md): Improper escaping of HTML ('Cross-site Scripting') in Wagtail StreamField blocks (CVSS 5.4)
- [CVE-2021-29434](https://cve.now/CVE-2021-29434.md): Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fields (CVSS 6.1)
- [CVE-2020-15118](https://cve.now/CVE-2020-15118.md): Cross-Site Scripting in Wagtail (CVSS 5.7)
- [CVE-2020-11037](https://cve.now/CVE-2020-11037.md): Potential Observable Timing Discrepancy in Wagtail (CVSS 6.1)
- [CVE-2020-11001](https://cve.now/CVE-2020-11001.md): Possible XSS attack in Wagtail (CVSS 5.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/wagtail
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.