{"schema_version":1,"title":"Wagtail vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 19 vulnerabilities in Wagtail: 0 in the last 7 days and 10 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-55468, was published on 24 August 2026. 1 technology has a page of its own.","url":"https://junglewise.ai/threats/vendors/wagtail","json_url":"https://junglewise.ai/threats/vendors/wagtail.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/wagtail","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":1,"all_time":19,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":10,"last_365_days":16},"latest":[{"cve":"CVE-2026-55468","cvss":4.3,"epss":0.0034,"slug":"cve-2026-55468-wagtail-pages-admin-api-improper-access-control","title":"Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective r","severity":"medium","exploited":false,"published_at":"2026-08-24T21:17:41.29+00:00","url":"https://junglewise.ai/threats/cve-2026-55468-wagtail-pages-admin-api-improper-access-control"},{"cvss":6.5,"slug":"wagtail-improper-permission-restriction-on-page-translation-api-871f4804","title":"Wagtail improper permission restriction on page translation API","severity":"medium","exploited":false,"published_at":"2026-08-20T18:45:27+00:00","url":"https://junglewise.ai/threats/wagtail-improper-permission-restriction-on-page-translation-api-871f4804"},{"cvss":6.5,"slug":"wagtail-improper-permission-handling-when-copying-snippets-7cffb199","title":"Wagtail improper permission handling when copying snippets","severity":"medium","exploited":false,"published_at":"2026-08-20T18:45:23+00:00","url":"https://junglewise.ai/threats/wagtail-improper-permission-handling-when-copying-snippets-7cffb199"},{"cvss":5.3,"slug":"wagtail-improper-restriction-handling-in-documents-and-images-api-0df25de5","title":"Wagtail improper restriction handling in Documents and Images API","severity":"medium","exploited":false,"published_at":"2026-08-20T18:45:14+00:00","url":"https://junglewise.ai/threats/wagtail-improper-restriction-handling-in-documents-and-images-api-0df25de5"},{"cvss":3.7,"slug":"wagtail-document-sha1-hash-enumeration-via-http-headers-c56639c4","title":"Wagtail document SHA1 hash enumeration via HTTP headers","severity":"low","exploited":false,"published_at":"2026-08-20T18:45:09+00:00","url":"https://junglewise.ai/threats/wagtail-document-sha1-hash-enumeration-via-http-headers-c56639c4"},{"cve":"CVE-2026-54263","cvss":7.3,"epss":0.0036,"slug":"cve-2026-54263-wagtail-reflected-xss-in-dynamic-image-url-generator","title":"Wagtail reflected XSS in dynamic image URL generator","severity":"high","exploited":false,"published_at":"2026-07-01T22:16:49.917+00:00","url":"https://junglewise.ai/threats/cve-2026-54263-wagtail-reflected-xss-in-dynamic-image-url-generator"},{"cve":"CVE-2026-54262","cvss":4.3,"epss":0.0027,"slug":"cve-2026-54262-wagtail-improper-permission-handling-in-simple-translation","title":"Wagtail improper permission handling in simple_translation","severity":"medium","exploited":false,"published_at":"2026-07-01T22:16:49.787+00:00","url":"https://junglewise.ai/threats/cve-2026-54262-wagtail-improper-permission-handling-in-simple-translation"},{"cve":"CVE-2026-54261","cvss":6.5,"epss":0.0034,"slug":"cve-2026-54261-wagtail-improper-permission-handling-in-image-preview","title":"Wagtail improper permission handling in image preview","severity":"medium","exploited":false,"published_at":"2026-07-01T22:16:49.653+00:00","url":"https://junglewise.ai/threats/cve-2026-54261-wagtail-improper-permission-handling-in-image-preview"},{"cve":"CVE-2026-54260","cvss":4.3,"epss":0.0037,"slug":"cve-2026-54260-wagtail-denial-of-service-via-unbounded-filter-specs-in-image","title":"Wagtail denial of service via unbounded filter specs in image preview","severity":"medium","exploited":false,"published_at":"2026-07-01T22:16:49.523+00:00","url":"https://junglewise.ai/threats/cve-2026-54260-wagtail-denial-of-service-via-unbounded-filter-specs-in-image"},{"cve":"CVE-2026-54259","cvss":4.3,"epss":0.0027,"slug":"cve-2026-54259-wagtail-improper-permissions-in-documents-and-images-chooser","title":"Wagtail improper permissions in Documents and Images chooser","severity":"medium","exploited":false,"published_at":"2026-07-01T22:16:49.297+00:00","url":"https://junglewise.ai/threats/cve-2026-54259-wagtail-improper-permissions-in-documents-and-images-chooser"},{"cve":"CVE-2026-44201","cvss":5.3,"epss":0.0031,"slug":"cve-2026-44201-wagtail-information-disclosure-in-documents-and-images-api","title":"Wagtail information disclosure in Documents and Images API","severity":"medium","exploited":false,"published_at":"2026-05-11T16:17:35.85+00:00","url":"https://junglewise.ai/threats/cve-2026-44201-wagtail-information-disclosure-in-documents-and-images-api"},{"cve":"CVE-2026-44200","cvss":6.5,"epss":0.0034,"slug":"cve-2026-44200-wagtail-improper-permission-handling-in-page-copying","title":"Wagtail improper permission handling in page copying","severity":"medium","exploited":false,"published_at":"2026-05-11T16:17:35.713+00:00","url":"https://junglewise.ai/threats/cve-2026-44200-wagtail-improper-permission-handling-in-page-copying"},{"cve":"CVE-2026-44199","cvss":6.5,"epss":0.003,"slug":"cve-2026-44199-wagtail-improper-permission-handling-in-form-submission-deletion","title":"Wagtail improper permission handling in form submission deletion","severity":"medium","exploited":false,"published_at":"2026-05-11T16:17:35.43+00:00","url":"https://junglewise.ai/threats/cve-2026-44199-wagtail-improper-permission-handling-in-form-submission-deletion"},{"cve":"CVE-2026-44198","cvss":4.3,"epss":0.0027,"slug":"cve-2026-44198-wagtail-improper-permission-handling-in-page-history-report","title":"Wagtail improper permission handling in page history report","severity":"medium","exploited":false,"published_at":"2026-05-11T16:17:35.057+00:00","url":"https://junglewise.ai/threats/cve-2026-44198-wagtail-improper-permission-handling-in-page-history-report"},{"cve":"CVE-2026-44197","cvss":6.5,"epss":0.0035,"slug":"cve-2026-44197-wagtail-improper-permission-handling-in-revision-compare-view","title":"Wagtail improper permission handling in revision compare view","severity":"medium","exploited":false,"published_at":"2026-05-11T16:17:34.823+00:00","url":"https://junglewise.ai/threats/cve-2026-44197-wagtail-improper-permission-handling-in-revision-compare-view"},{"cve":"CVE-2026-28222","cvss":6.1,"epss":0.0059,"slug":"cve-2026-28222-wagtail-stored-xss-in-tableblock-class-attributes","title":"Wagtail stored XSS in TableBlock class attributes","severity":"medium","exploited":false,"published_at":"2026-03-03T17:57:18+00:00","url":"https://junglewise.ai/threats/cve-2026-28222-wagtail-stored-xss-in-tableblock-class-attributes"},{"cve":"CVE-2024-39317","cvss":6.5,"epss":0.0062,"slug":"cve-2024-39317-wagtail-redos-in-parse-query-string","title":"Wagtail ReDoS in parse_query_string","severity":"medium","exploited":false,"published_at":"2024-07-11T13:21:42+00:00","url":"https://junglewise.ai/threats/cve-2024-39317-wagtail-redos-in-parse-query-string"},{"cve":"CVE-2021-32681","cvss":5.4,"epss":0.0111,"slug":"cve-2021-32681-wagtail-xss-in-streamfield-include-block-tag","title":"Wagtail XSS in StreamField include_block tag","severity":"medium","exploited":false,"published_at":"2021-06-17T20:10:42+00:00","url":"https://junglewise.ai/threats/cve-2021-32681-wagtail-xss-in-streamfield-include-block-tag"},{"cve":"CVE-2020-15118","cvss":3.1,"epss":0.011,"slug":"cve-2020-15118-wagtail-cross-site-scripting-in-form-field-help-text","title":"PYSEC-2020-154 - In Wagtail before versions 2.7.4 and 2.9.3, when a form page type is made available to Wagtail editors through the `wagtail.contrib.forms` a","severity":"low","exploited":false,"published_at":"2020-07-20T18:15:00+00:00","url":"https://junglewise.ai/threats/cve-2020-15118-wagtail-cross-site-scripting-in-form-field-help-text"}],"vendor":{"hub":true,"name":"Wagtail","slug":"wagtail","homepage":"https://wagtail.org/","description":"Wagtail is an open-source content management system built on the Django web framework.","url":"https://junglewise.ai/threats/vendors/wagtail"},"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":5},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":4},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-54263","cvss":7.3,"epss":0.0036,"slug":"cve-2026-54263-wagtail-reflected-xss-in-dynamic-image-url-generator","title":"Wagtail reflected XSS in dynamic image URL generator","severity":"high","exploited":false,"published_at":"2026-07-01T22:16:49.917+00:00","url":"https://junglewise.ai/threats/cve-2026-54263-wagtail-reflected-xss-in-dynamic-image-url-generator"},{"cve":"CVE-2024-39317","cvss":6.5,"epss":0.0062,"slug":"cve-2024-39317-wagtail-redos-in-parse-query-string","title":"Wagtail ReDoS in parse_query_string","severity":"medium","exploited":false,"published_at":"2024-07-11T13:21:42+00:00","url":"https://junglewise.ai/threats/cve-2024-39317-wagtail-redos-in-parse-query-string"},{"cve":"CVE-2026-44197","cvss":6.5,"epss":0.0035,"slug":"cve-2026-44197-wagtail-improper-permission-handling-in-revision-compare-view","title":"Wagtail improper permission handling in revision compare view","severity":"medium","exploited":false,"published_at":"2026-05-11T16:17:34.823+00:00","url":"https://junglewise.ai/threats/cve-2026-44197-wagtail-improper-permission-handling-in-revision-compare-view"},{"cve":"CVE-2026-54261","cvss":6.5,"epss":0.0034,"slug":"cve-2026-54261-wagtail-improper-permission-handling-in-image-preview","title":"Wagtail improper permission handling in image preview","severity":"medium","exploited":false,"published_at":"2026-07-01T22:16:49.653+00:00","url":"https://junglewise.ai/threats/cve-2026-54261-wagtail-improper-permission-handling-in-image-preview"},{"cve":"CVE-2026-44200","cvss":6.5,"epss":0.0034,"slug":"cve-2026-44200-wagtail-improper-permission-handling-in-page-copying","title":"Wagtail improper permission handling in page copying","severity":"medium","exploited":false,"published_at":"2026-05-11T16:17:35.713+00:00","url":"https://junglewise.ai/threats/cve-2026-44200-wagtail-improper-permission-handling-in-page-copying"},{"cve":"CVE-2026-44199","cvss":6.5,"epss":0.003,"slug":"cve-2026-44199-wagtail-improper-permission-handling-in-form-submission-deletion","title":"Wagtail improper permission handling in form submission deletion","severity":"medium","exploited":false,"published_at":"2026-05-11T16:17:35.43+00:00","url":"https://junglewise.ai/threats/cve-2026-44199-wagtail-improper-permission-handling-in-form-submission-deletion"},{"cvss":6.5,"slug":"wagtail-improper-permission-restriction-on-page-translation-api-871f4804","title":"Wagtail improper permission restriction on page translation API","severity":"medium","exploited":false,"published_at":"2026-08-20T18:45:27+00:00","url":"https://junglewise.ai/threats/wagtail-improper-permission-restriction-on-page-translation-api-871f4804"},{"cvss":6.5,"slug":"wagtail-improper-permission-handling-when-copying-snippets-7cffb199","title":"Wagtail improper permission handling when copying snippets","severity":"medium","exploited":false,"published_at":"2026-08-20T18:45:23+00:00","url":"https://junglewise.ai/threats/wagtail-improper-permission-handling-when-copying-snippets-7cffb199"},{"cve":"CVE-2026-28222","cvss":6.1,"epss":0.0059,"slug":"cve-2026-28222-wagtail-stored-xss-in-tableblock-class-attributes","title":"Wagtail stored XSS in TableBlock class attributes","severity":"medium","exploited":false,"published_at":"2026-03-03T17:57:18+00:00","url":"https://junglewise.ai/threats/cve-2026-28222-wagtail-stored-xss-in-tableblock-class-attributes"},{"cve":"CVE-2021-32681","cvss":5.4,"epss":0.0111,"slug":"cve-2021-32681-wagtail-xss-in-streamfield-include-block-tag","title":"Wagtail XSS in StreamField include_block tag","severity":"medium","exploited":false,"published_at":"2021-06-17T20:10:42+00:00","url":"https://junglewise.ai/threats/cve-2021-32681-wagtail-xss-in-streamfield-include-block-tag"}],"generated_at":"2026-09-26T12:07:00.15149+00:00","technologies":[{"name":"Wagtail","slug":"wagtail","vulnerabilities":20,"url":"https://junglewise.ai/threats/technologies/wagtail"}]}