{"schema_version":1,"title":"wagtail (PyPI) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 26 vulnerabilities in wagtail (PyPI): 0 in the last 7 days and 9 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-55468, was published on 24 August 2026.","url":"https://junglewise.ai/threats/technologies/pypi-wagtail","json_url":"https://junglewise.ai/threats/technologies/pypi-wagtail.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/pypi-wagtail","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":1,"all_time":26,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":9,"last_365_days":16},"latest":[{"cve":"CVE-2026-55468","cvss":4.3,"epss":0.0034,"slug":"cve-2026-55468-wagtail-pages-admin-api-improper-access-control","title":"Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective r","severity":"medium","exploited":false,"published_at":"2026-08-24T21:17:41.29+00:00","url":"https://junglewise.ai/threats/cve-2026-55468-wagtail-pages-admin-api-improper-access-control"},{"cve":"CVE-2026-25517","cvss":4,"epss":0.0045,"slug":"cve-2026-25517-wagtail-has-improper-permission-handling-on-admin-preview","title":"PYSEC-2026-2030 - Wagtail has improper permission handling on admin preview endpoints","severity":"medium","exploited":false,"published_at":"2026-07-07T16:42:05.813187+00:00","url":"https://junglewise.ai/threats/cve-2026-25517-wagtail-has-improper-permission-handling-on-admin-preview"},{"cve":"CVE-2024-35228","cvss":3.1,"epss":0.0033,"slug":"cve-2024-35228-improper-handling-of-insufficient-permissions-in-wagtail-contrib","title":"PYSEC-2026-2032 - Improper Handling of Insufficient Permissions in `wagtail.contrib.settings`","severity":"low","exploited":false,"published_at":"2026-07-07T11:45:44.164164+00:00","url":"https://junglewise.ai/threats/cve-2024-35228-improper-handling-of-insufficient-permissions-in-wagtail-contrib"},{"cve":"CVE-2024-32882","cvss":3.1,"epss":0.0048,"slug":"cve-2024-32882-wagtail-has-permission-check-bypass-when-editing-a-model-with-per","title":"PYSEC-2026-2031 - Wagtail has permission check bypass when editing a model with per-field restrictions through `wagtail.contrib.settings` or `ModelViewSet`","severity":"low","exploited":false,"published_at":"2026-07-07T11:45:40.445115+00:00","url":"https://junglewise.ai/threats/cve-2024-32882-wagtail-has-permission-check-bypass-when-editing-a-model-with-per"},{"cve":"CVE-2026-54263","cvss":7.3,"epss":0.0036,"slug":"cve-2026-54263-wagtail-reflected-xss-in-dynamic-image-url-generator","title":"Wagtail reflected XSS in dynamic image URL generator","severity":"high","exploited":false,"published_at":"2026-07-01T22:16:49.917+00:00","url":"https://junglewise.ai/threats/cve-2026-54263-wagtail-reflected-xss-in-dynamic-image-url-generator"},{"cve":"CVE-2026-54262","cvss":4.3,"epss":0.0027,"slug":"cve-2026-54262-wagtail-improper-permission-handling-in-simple-translation","title":"Wagtail improper permission handling in simple_translation","severity":"medium","exploited":false,"published_at":"2026-07-01T22:16:49.787+00:00","url":"https://junglewise.ai/threats/cve-2026-54262-wagtail-improper-permission-handling-in-simple-translation"},{"cve":"CVE-2026-54261","cvss":6.5,"epss":0.0034,"slug":"cve-2026-54261-wagtail-improper-permission-handling-in-image-preview","title":"Wagtail improper permission handling in image preview","severity":"medium","exploited":false,"published_at":"2026-07-01T22:16:49.653+00:00","url":"https://junglewise.ai/threats/cve-2026-54261-wagtail-improper-permission-handling-in-image-preview"},{"cve":"CVE-2026-54260","cvss":4.3,"epss":0.0037,"slug":"cve-2026-54260-wagtail-denial-of-service-via-unbounded-filter-specs-in-image","title":"Wagtail denial of service via unbounded filter specs in image preview","severity":"medium","exploited":false,"published_at":"2026-07-01T22:16:49.523+00:00","url":"https://junglewise.ai/threats/cve-2026-54260-wagtail-denial-of-service-via-unbounded-filter-specs-in-image"},{"cve":"CVE-2026-54259","cvss":4.3,"epss":0.0027,"slug":"cve-2026-54259-wagtail-improper-permissions-in-documents-and-images-chooser","title":"Wagtail improper permissions in Documents and Images chooser","severity":"medium","exploited":false,"published_at":"2026-07-01T22:16:49.297+00:00","url":"https://junglewise.ai/threats/cve-2026-54259-wagtail-improper-permissions-in-documents-and-images-chooser"},{"cve":"CVE-2026-44201","cvss":5.3,"epss":0.0031,"slug":"cve-2026-44201-wagtail-information-disclosure-in-documents-and-images-api","title":"Wagtail information disclosure in Documents and Images API","severity":"medium","exploited":false,"published_at":"2026-05-11T16:17:35.85+00:00","url":"https://junglewise.ai/threats/cve-2026-44201-wagtail-information-disclosure-in-documents-and-images-api"},{"cve":"CVE-2026-44200","cvss":6.5,"epss":0.0034,"slug":"cve-2026-44200-wagtail-improper-permission-handling-in-page-copying","title":"Wagtail improper permission handling in page copying","severity":"medium","exploited":false,"published_at":"2026-05-11T16:17:35.713+00:00","url":"https://junglewise.ai/threats/cve-2026-44200-wagtail-improper-permission-handling-in-page-copying"},{"cve":"CVE-2026-44199","cvss":6.5,"epss":0.003,"slug":"cve-2026-44199-wagtail-improper-permission-handling-in-form-submission-deletion","title":"Wagtail improper permission handling in form submission deletion","severity":"medium","exploited":false,"published_at":"2026-05-11T16:17:35.43+00:00","url":"https://junglewise.ai/threats/cve-2026-44199-wagtail-improper-permission-handling-in-form-submission-deletion"},{"cve":"CVE-2026-44198","cvss":4.3,"epss":0.0027,"slug":"cve-2026-44198-wagtail-improper-permission-handling-in-page-history-report","title":"Wagtail improper permission handling in page history report","severity":"medium","exploited":false,"published_at":"2026-05-11T16:17:35.057+00:00","url":"https://junglewise.ai/threats/cve-2026-44198-wagtail-improper-permission-handling-in-page-history-report"},{"cve":"CVE-2026-44197","cvss":6.5,"epss":0.0035,"slug":"cve-2026-44197-wagtail-improper-permission-handling-in-revision-compare-view","title":"Wagtail improper permission handling in revision compare view","severity":"medium","exploited":false,"published_at":"2026-05-11T16:17:34.823+00:00","url":"https://junglewise.ai/threats/cve-2026-44197-wagtail-improper-permission-handling-in-revision-compare-view"},{"cve":"CVE-2026-28223","cvss":3.1,"epss":0.0059,"slug":"cve-2026-28223-wagtail-vulnerable-to-cross-site-scripting-in-simple-translation","title":"PYSEC-2026-2308 - Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site s","severity":"low","exploited":false,"published_at":"2026-03-05T20:16:15.493+00:00","url":"https://junglewise.ai/threats/cve-2026-28223-wagtail-vulnerable-to-cross-site-scripting-in-simple-translation"},{"cve":"CVE-2026-28222","cvss":6.1,"epss":0.0059,"slug":"cve-2026-28222-wagtail-stored-xss-in-tableblock-class-attributes","title":"Wagtail stored XSS in TableBlock class attributes","severity":"medium","exploited":false,"published_at":"2026-03-03T17:57:18+00:00","url":"https://junglewise.ai/threats/cve-2026-28222-wagtail-stored-xss-in-tableblock-class-attributes"},{"cve":"CVE-2024-39317","cvss":6.5,"epss":0.0062,"slug":"cve-2024-39317-wagtail-redos-in-parse-query-string","title":"Wagtail ReDoS in parse_query_string","severity":"medium","exploited":false,"published_at":"2024-07-11T13:21:42+00:00","url":"https://junglewise.ai/threats/cve-2024-39317-wagtail-redos-in-parse-query-string"},{"cve":"CVE-2023-45809","cvss":3.1,"epss":0.0045,"slug":"cve-2023-45809-wagtail-vulnerable-to-disclosure-of-user-names-via-admin-bulk","title":"PYSEC-2023-219 - Wagtail is an open source content management system built on Django. A user with a limited-permission editor account for the Wagtail admin c","severity":"low","exploited":false,"published_at":"2023-10-19T19:15:00+00:00","url":"https://junglewise.ai/threats/cve-2023-45809-wagtail-vulnerable-to-disclosure-of-user-names-via-admin-bulk"},{"cve":"CVE-2023-28836","cvss":3.1,"epss":0.0078,"slug":"cve-2023-28836-wagtail-vulnerable-to-stored-cross-site-scripting-attack-via","title":"PYSEC-2023-55 - Wagtail is an open source content management system built on Django. Starting in version 1.5 and prior to versions 4.1.4 and 4.2.2, a stored","severity":"low","exploited":false,"published_at":"2023-04-03T17:15:00+00:00","url":"https://junglewise.ai/threats/cve-2023-28836-wagtail-vulnerable-to-stored-cross-site-scripting-attack-via"},{"cve":"CVE-2023-28837","cvss":3.1,"epss":0.0107,"slug":"cve-2023-28837-wagtail-denial-of-service-via-memory-exhaustion-in-file-upload","title":"PYSEC-2023-56 - Wagtail is an open source content management system built on Django. Prior to versions 4.1.4 and 4.2.2, a memory exhaustion bug exists in Wa","severity":"low","exploited":false,"published_at":"2023-04-03T17:15:00+00:00","url":"https://junglewise.ai/threats/cve-2023-28837-wagtail-denial-of-service-via-memory-exhaustion-in-file-upload"},{"cve":"CVE-2022-21683","cvss":3.1,"epss":0.0097,"slug":"cve-2022-21683-comment-reply-notifications-sent-to-incorrect-users","title":"PYSEC-2022-13 - Wagtail is a Django based content management system focused on flexibility and user experience. When notifications for new replies in commen","severity":"low","exploited":false,"published_at":"2022-01-18T18:15:00+00:00","url":"https://junglewise.ai/threats/cve-2022-21683-comment-reply-notifications-sent-to-incorrect-users"},{"cve":"CVE-2021-32681","cvss":5.4,"epss":0.0111,"slug":"cve-2021-32681-wagtail-xss-in-streamfield-include-block-tag","title":"Wagtail XSS in StreamField include_block tag","severity":"medium","exploited":false,"published_at":"2021-06-17T20:10:42+00:00","url":"https://junglewise.ai/threats/cve-2021-32681-wagtail-xss-in-streamfield-include-block-tag"},{"cve":"CVE-2021-29434","cvss":3.1,"epss":0.0063,"slug":"cve-2021-29434-improper-validation-of-urls-cross-site-scripting-in-wagtail-rich","title":"PYSEC-2021-114 - Wagtail is a Django content management system. In affected versions of Wagtail, when saving the contents of a rich text field in the admin i","severity":"low","exploited":false,"published_at":"2021-04-19T19:15:00+00:00","url":"https://junglewise.ai/threats/cve-2021-29434-improper-validation-of-urls-cross-site-scripting-in-wagtail-rich"},{"cve":"CVE-2020-15118","cvss":3.1,"epss":0.011,"slug":"cve-2020-15118-wagtail-cross-site-scripting-in-form-field-help-text","title":"PYSEC-2020-154 - In Wagtail before versions 2.7.4 and 2.9.3, when a form page type is made available to Wagtail editors through the `wagtail.contrib.forms` a","severity":"low","exploited":false,"published_at":"2020-07-20T18:15:00+00:00","url":"https://junglewise.ai/threats/cve-2020-15118-wagtail-cross-site-scripting-in-form-field-help-text"},{"cve":"CVE-2020-11037","cvss":3.1,"epss":0.0025,"slug":"cve-2020-11037-potential-observable-timing-discrepancy-in-wagtail","title":"PYSEC-2020-153 - In Wagtail before versions 2.7.2 and 2.8.2, a potential timing attack exists on pages or documents that have been protected with a shared pa","severity":"low","exploited":false,"published_at":"2020-04-30T23:15:00+00:00","url":"https://junglewise.ai/threats/cve-2020-11037-potential-observable-timing-discrepancy-in-wagtail"}],"weekly":[{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":3},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"tensorflow (PyPI)","slug":"pypi-tensorflow","vulnerabilities":428,"url":"https://junglewise.ai/threats/technologies/pypi-tensorflow"},{"name":"tensorflow-cpu (PyPI)","slug":"tensorflow-cpu","vulnerabilities":424,"url":"https://junglewise.ai/threats/technologies/tensorflow-cpu"},{"name":"tensorflow-gpu (PyPI)","slug":"tensorflow-gpu","vulnerabilities":421,"url":"https://junglewise.ai/threats/technologies/tensorflow-gpu"},{"name":"open-webui (PyPI)","slug":"open-webui","vulnerabilities":177,"url":"https://junglewise.ai/threats/technologies/open-webui"},{"name":"Django (PyPI)","slug":"django","vulnerabilities":172,"url":"https://junglewise.ai/threats/technologies/django"},{"name":"apache-airflow (PyPI)","slug":"apache-airflow","vulnerabilities":152,"url":"https://junglewise.ai/threats/technologies/apache-airflow"},{"name":"plone (PyPI)","slug":"pypi-plone","vulnerabilities":101,"url":"https://junglewise.ai/threats/technologies/pypi-plone"},{"name":"praisonai (PyPI)","slug":"pypi-praisonai","vulnerabilities":86,"url":"https://junglewise.ai/threats/technologies/pypi-praisonai"},{"name":"exiv2 (PyPI)","slug":"exiv2","vulnerabilities":85,"url":"https://junglewise.ai/threats/technologies/exiv2"},{"name":"nltk (PyPI)","slug":"nltk","vulnerabilities":83,"url":"https://junglewise.ai/threats/technologies/nltk"},{"name":"mlflow (PyPI)","slug":"mlflow","vulnerabilities":82,"url":"https://junglewise.ai/threats/technologies/mlflow"},{"name":"pillow (PyPI)","slug":"pillow","vulnerabilities":79,"url":"https://junglewise.ai/threats/technologies/pillow"}],"technology":{"hub":true,"name":"wagtail (PyPI)","slug":"pypi-wagtail","vendor":{"name":"PyPI","slug":"pypi","url":"https://junglewise.ai/threats/vendors/pypi"},"aliases":[],"description":"Django-based open-source content management system with page editing, site administration, and publishing.","url":"https://junglewise.ai/threats/technologies/pypi-wagtail"},"most_severe":[{"cve":"CVE-2026-54263","cvss":7.3,"epss":0.0036,"slug":"cve-2026-54263-wagtail-reflected-xss-in-dynamic-image-url-generator","title":"Wagtail reflected XSS in dynamic image URL generator","severity":"high","exploited":false,"published_at":"2026-07-01T22:16:49.917+00:00","url":"https://junglewise.ai/threats/cve-2026-54263-wagtail-reflected-xss-in-dynamic-image-url-generator"},{"cve":"CVE-2024-39317","cvss":6.5,"epss":0.0062,"slug":"cve-2024-39317-wagtail-redos-in-parse-query-string","title":"Wagtail ReDoS in parse_query_string","severity":"medium","exploited":false,"published_at":"2024-07-11T13:21:42+00:00","url":"https://junglewise.ai/threats/cve-2024-39317-wagtail-redos-in-parse-query-string"},{"cve":"CVE-2026-44197","cvss":6.5,"epss":0.0035,"slug":"cve-2026-44197-wagtail-improper-permission-handling-in-revision-compare-view","title":"Wagtail improper permission handling in revision compare view","severity":"medium","exploited":false,"published_at":"2026-05-11T16:17:34.823+00:00","url":"https://junglewise.ai/threats/cve-2026-44197-wagtail-improper-permission-handling-in-revision-compare-view"},{"cve":"CVE-2026-54261","cvss":6.5,"epss":0.0034,"slug":"cve-2026-54261-wagtail-improper-permission-handling-in-image-preview","title":"Wagtail improper permission handling in image preview","severity":"medium","exploited":false,"published_at":"2026-07-01T22:16:49.653+00:00","url":"https://junglewise.ai/threats/cve-2026-54261-wagtail-improper-permission-handling-in-image-preview"},{"cve":"CVE-2026-44200","cvss":6.5,"epss":0.0034,"slug":"cve-2026-44200-wagtail-improper-permission-handling-in-page-copying","title":"Wagtail improper permission handling in page copying","severity":"medium","exploited":false,"published_at":"2026-05-11T16:17:35.713+00:00","url":"https://junglewise.ai/threats/cve-2026-44200-wagtail-improper-permission-handling-in-page-copying"},{"cve":"CVE-2026-44199","cvss":6.5,"epss":0.003,"slug":"cve-2026-44199-wagtail-improper-permission-handling-in-form-submission-deletion","title":"Wagtail improper permission handling in form submission deletion","severity":"medium","exploited":false,"published_at":"2026-05-11T16:17:35.43+00:00","url":"https://junglewise.ai/threats/cve-2026-44199-wagtail-improper-permission-handling-in-form-submission-deletion"},{"cve":"CVE-2026-28222","cvss":6.1,"epss":0.0059,"slug":"cve-2026-28222-wagtail-stored-xss-in-tableblock-class-attributes","title":"Wagtail stored XSS in TableBlock class attributes","severity":"medium","exploited":false,"published_at":"2026-03-03T17:57:18+00:00","url":"https://junglewise.ai/threats/cve-2026-28222-wagtail-stored-xss-in-tableblock-class-attributes"},{"cve":"CVE-2021-32681","cvss":5.4,"epss":0.0111,"slug":"cve-2021-32681-wagtail-xss-in-streamfield-include-block-tag","title":"Wagtail XSS in StreamField include_block tag","severity":"medium","exploited":false,"published_at":"2021-06-17T20:10:42+00:00","url":"https://junglewise.ai/threats/cve-2021-32681-wagtail-xss-in-streamfield-include-block-tag"},{"cve":"CVE-2026-44201","cvss":5.3,"epss":0.0031,"slug":"cve-2026-44201-wagtail-information-disclosure-in-documents-and-images-api","title":"Wagtail information disclosure in Documents and Images API","severity":"medium","exploited":false,"published_at":"2026-05-11T16:17:35.85+00:00","url":"https://junglewise.ai/threats/cve-2026-44201-wagtail-information-disclosure-in-documents-and-images-api"},{"cve":"CVE-2026-54260","cvss":4.3,"epss":0.0037,"slug":"cve-2026-54260-wagtail-denial-of-service-via-unbounded-filter-specs-in-image","title":"Wagtail denial of service via unbounded filter specs in image preview","severity":"medium","exploited":false,"published_at":"2026-07-01T22:16:49.523+00:00","url":"https://junglewise.ai/threats/cve-2026-54260-wagtail-denial-of-service-via-unbounded-filter-specs-in-image"}],"generated_at":"2026-09-28T03:07:00.154823+00:00"}