Torchbox
Torchbox Wagtail: vulnerabilidades y CVE
Torchbox Wagtail tiene 26 vulnerabilidades publicadas, 14 de ellas en los últimos 12 meses. 0 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE26
Últimos 12 meses14
Críticas0
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-55468 | Media (4.3) | 0.34% | — | 24 ago 2026 | Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in… |
| CVE-2026-54263 | Alta (7.3) | 0.36% | — | 1 jul 2026 | Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, reflected cross-site scripting (XSS) vulnerability exists on the dynamic image URL generator view within… |
| CVE-2026-54262 | Media (4.3) | 0.27% | — | 1 jul 2026 | Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, a low-level user with the "Can submit translation" permission can create translations for any page,… |
| CVE-2026-54261 | Media (6.5) | 0.34% | — | 1 jul 2026 | Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, due to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin… |
| CVE-2026-54260 | Baja (2.7) | 0.37% | — | 1 jul 2026 | Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, an authenticated admin user can trigger expensive rendition processing with purposefully crafted filter… |
| CVE-2026-54259 | Media (4.3) | 0.27% | — | 1 jul 2026 | Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, the Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not… |
| CVE-2026-44201 | Media (5.3) | 0.31% | — | 11 may 2026 | Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see… |
| CVE-2026-44200 | Media (6.5) | 0.34% | — | 11 may 2026 | Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do.… |
| CVE-2026-44199 | Media (6.5) | 0.30% | — | 11 may 2026 | Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by… |
| CVE-2026-44198 | Media (4.3) | 0.27% | — | 11 may 2026 | Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially… |
| CVE-2026-44197 | Media (6.5) | 0.35% | — | 11 may 2026 | Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if… |
| CVE-2026-28223 | Media (6.1) | 0.59% | — | 5 mar 2026 | Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on confirmation messages within the… |
| CVE-2026-28222 | Media (6.1) | 0.59% | — | 5 mar 2026 | Wagtail is an open source content management system built on Django. Prior to versions 6.3.8, 7.0.6, 7.2.3, and 7.3.1, a stored cross-site scripting (XSS) vulnerability exists on rendering TableBlock blocks within a… |
| CVE-2026-25517 | Media (5.1) | 0.45% | — | 4 feb 2026 | Wagtail is an open source content management system built on Django. Prior to versions 6.3.6, 7.0.4, 7.1.3, 7.2.2, and 7.3, due to a missing permission check on the preview endpoints, a user with access to the Wagtail… |
| CVE-2024-39317 | Media (4.9) | 0.61% | — | 11 jul 2024 | Wagtail is an open source content management system built on Django. A bug in Wagtail's `parse_query_string` would result in it taking a long time to process suitably crafted inputs. When used to parse sufficiently long… |
| CVE-2024-35228 | Media (5.5) | 0.33% | — | 30 may 2024 | Wagtail is an open source content management system built on Django. Due to an improperly applied permission check in the `wagtail.contrib.settings` module, a user with access to the Wagtail admin and knowledge of the… |
| CVE-2024-32882 | Baja (2.7) | 0.48% | — | 2 may 2024 | Wagtail is an open source content management system built on Django. In affected versions if a model has been made available for editing through the `wagtail.contrib.settings` module or `ModelViewSet`, and the… |
| CVE-2023-45809 | Baja (2.7) | 0.45% | — | 19 oct 2023 | Wagtail is an open source content management system built on Django. A user with a limited-permission editor account for the Wagtail admin can make a direct URL request to the admin view that handles bulk actions on… |
| CVE-2023-28837 | Media (4.9) | 1.1% | — | 3 abr 2023 | Wagtail is an open source content management system built on Django. Prior to versions 4.1.4 and 4.2.2, a memory exhaustion bug exists in Wagtail's handling of uploaded images and documents. For both images and… |
| CVE-2023-28836 | Media (5.4) | 0.78% | — | 3 abr 2023 | Wagtail is an open source content management system built on Django. Starting in version 1.5 and prior to versions 4.1.4 and 4.2.2, a stored cross-site scripting (XSS) vulnerability exists on ModelAdmin views within the… |
| CVE-2022-21683 | Media (4.3) | 0.97% | — | 18 ene 2022 | Wagtail is a Django based content management system focused on flexibility and user experience. When notifications for new replies in comment threads are sent, they are sent to all users who have replied or commented… |
| CVE-2021-32681 | Media (5.4) | 1.1% | — | 17 jun 2021 | Wagtail is an open source content management system built on Django. A cross-site scripting vulnerability exists in versions 2.13-2.13.1, versions 2.12-2.12.4, and versions prior to 2.11.8. When the `{% include_block… |
| CVE-2021-29434 | Media (4.8) | 0.63% | — | 19 abr 2021 | Wagtail is a Django content management system. In affected versions of Wagtail, when saving the contents of a rich text field in the admin interface, Wagtail does not apply server-side checks to ensure that link URLs… |
| CVE-2020-15118 | Media (5.4) | 1.1% | — | 20 jul 2020 | In Wagtail before versions 2.7.4 and 2.9.3, when a form page type is made available to Wagtail editors through the `wagtail.contrib.forms` app, and the page template is built using Django's standard form rendering… |
| CVE-2020-11037 | Media (4.7) | 0.25% | — | 30 abr 2020 | In Wagtail before versions 2.7.3 and 2.8.2, a potential timing attack exists on pages or documents that have been protected with a shared password through Wagtail's "Privacy" controls. This password check is performed… |
| CVE-2020-11001 | Media (6.8) | 1.3% | — | 14 abr 2020 | In Wagtail before versions 2.8.1 and 2.7.2, a cross-site scripting (XSS) vulnerability exists on the page revision comparison view within the Wagtail admin interface. A user with a limited-permission editor account for… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.