CVE-2026-77648

In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass importfilteringopts, allowing an admin to fetch internal URLs from the Glance service network aka SSRF, as long as https:// or http:// is used. This API has been available only to admins since Xena, and it...

CVE-2025-52182

The Library Corporation LS2 Admin v5.7 to v5.8.0 was discovered to contain an information disclosure vulnerability...

CVE-2026-53804

OTRS Community Edition contains an authenticated OS command injection vulnerability in the PGP encryption module that allows administrators to execute arbitrary operating-system commands by supplying crafted values for the PGP binary path and command options. Administrator-supplied configuration...

CVE-2026-53804 OTRS Community Edition OS Command Injection via PGP Configuration

OTRS Community Edition contains an authenticated OS command injection vulnerability in the PGP encryption module that allows administrators to execute arbitrary operating-system commands by supplying crafted values for the PGP binary path and command options. Administrator-supplied configuration...

CVE-2026-63003

creationtimestamp| type| source ---|---|--- 2026-08-20 20:35:15+00:00| published-proof-of-concept| https://github.com/django-cms/django-cms/security/advisories/GHSA-6x92-6vx4-5fwr...

EUVD-2026-63551

Shaarli is a personal bookmarking service. Versions prior to 0.16.3 are vulnerable to stored XSS in application/front/controller/visitor/BookmarkListController.php. The permalink handler concatenates the raw $bookmark-getTitle into the pagetitle template variable and the RainTPL template emits it...

Wagtail: Improper restriction handling on Page translation API endpoint

Impact A CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. Patches Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and...

GHSA-JM5P-837G-RV8G Wagtail: Improper restriction handling on Page translation API endpoint

Impact A CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. Patches Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and...

Improper Handling of Insufficient Permissions or Privileges

Overview wagtail is an open source content management system built on Django. Affected versions of this package are vulnerable to Improper Handling of Insufficient Permissions or Privileges via the copy for translation endpoint in the Admin API. An attacker can access the contents of pages they d...

GHSA-3VRH-M9W7-V94F Wagtail: Improper restriction handling on Pages admin API

Impact The internal Pages admin API incorrectly returns page fields without access control when they are declared in apifields. A user with access to the Wagtail admin can use this API to fetch draft and live page fields’ contents that are part of apifields on the base page model title, slug,...

EUVD-2026-41150

Wagtail: Reflected XSS in dynamic image URL generator view...

GHSA-23M2-MGHX-VQMF Wagtail: Reflected XSS in dynamic image URL generator view

Impact A reflected cross-site scripting XSS vulnerability exists on the dynamic image URL generator view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could craft a URL that, when viewed by a user with higher privileges, could perform...

Wagtail: Reflected XSS in dynamic image URL generator view

Impact A reflected cross-site scripting XSS vulnerability exists on the dynamic image URL generator view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could craft a URL that, when viewed by a user with higher privileges, could perform...

wagtail-sb-admin-interface (>=0.6.0, <=0.7.0), wagtail-sb-codefield (0.4.0) +4 more potentially affected by CVE-2026-54262 via wagtail (6.0.0rc1)

wagtail PYPI version 6.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-sb-admin-interface =0.6.0, =0.1.0, =0.1.0, =0.2.0 Source cves: CVE-2026-54262 Source advisory: OSV:GHSA-8634-MR4J-R72C...

EUVD-2026-41148

Wagtail: Improper permission handling in image preview...

Wagtail: Improper permission handling in image preview

Impact Due to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin...

GHSA-R6P4-GRQ7-XM4M Wagtail: Improper permission handling in image preview

Impact Due to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin...

EUVD-2026-41146

Wagtail: Denial of service via unbounded filter specs in the image preview...

Wagtail: Improper restriction handling on Documents and Images chosen endpoints

Impact The Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not...

GHSA-H54R-XQ46-QWQM Wagtail: Improper restriction handling on Documents and Images chosen endpoints

Impact The Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections. The vulnerability is not...