CVE-2026-53804

OTRS Community Edition contains an authenticated OS command injection vulnerability in the PGP encryption module that allows administrators to execute arbitrary operating-system commands by supplying crafted values for the PGP binary path and command options. Administrator-supplied configuration...

CVE-2026-53804 OTRS Community Edition OS Command Injection via PGP Configuration

OTRS Community Edition contains an authenticated OS command injection vulnerability in the PGP encryption module that allows administrators to execute arbitrary operating-system commands by supplying crafted values for the PGP binary path and command options. Administrator-supplied configuration...

CVE-2026-63003

creationtimestamp| type| source ---|---|--- 2026-08-20 20:35:15+00:00| published-proof-of-concept| https://github.com/django-cms/django-cms/security/advisories/GHSA-6x92-6vx4-5fwr...

EUVD-2026-63551

Shaarli is a personal bookmarking service. Versions prior to 0.16.3 are vulnerable to stored XSS in application/front/controller/visitor/BookmarkListController.php. The permalink handler concatenates the raw $bookmark-getTitle into the pagetitle template variable and the RainTPL template emits it...

Improper Handling of Insufficient Permissions or Privileges

Overview wagtail is an open source content management system built on Django. Affected versions of this package are vulnerable to Improper Handling of Insufficient Permissions or Privileges via the copy for translation endpoint in the Admin API. An attacker can access the contents of pages they d...

Wagtail: Improper restriction handling on Page translation API endpoint

Impact A CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. Patches Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and...

GHSA-JM5P-837G-RV8G Wagtail: Improper restriction handling on Page translation API endpoint

Impact A CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. Patches Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and...

wagtail-sb-admin-interface (0.7.0), wagtail-sb-codefield (0.4.0) +4 more potentially affected by unknown CVE via wagtail (6.0.0rc1)

wagtail PYPI version 6.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-sb-admin-interface 0.7.0 - wagtail-sb-codefield 0.4.0 - wagtail-sb-fontawesome 0.3.0 - wagtail-sb-imageserializer =0.1.0, =0.1.0, =0.2....

coop (>=2.12.0, <=2.12.6), meine-stadt-transparent (0.2.12) +7 more potentially affected by unknown CVE via wagtail (2.12.6)

wagtail PYPI version 2.12.6 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - coop =2.12.0, =0.2.0, =0.10.2, =0.11.0 - wagtail-nav-menus 3.5.0 - wagtail-tag-manager 0.25.1 - wagtailstreamforms 3.14.0 Source cves: unknown CV...

wagtail-sb-admin-interface (>=0.0.0, <=0.5.0), wagtail-sb-codefield (>=0.1.0, <=0.3.0) +2 more potentially affected by unknown CVE via wagtail (5.0.0rc1)

wagtail PYPI version 5.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-sb-admin-interface =0.0.0, =0.1.0, =0.1.0, =0.4.0, =0.6.0 Source cves: unknown CVE Source advisory: OSV:GHSA-X5CX-W6P2-MXF2...

wagtail-sb-admin-interface (0.7.0), wagtail-sb-codefield (0.4.0) +4 more potentially affected by unknown CVE via wagtail (6.0.0rc1)

wagtail PYPI version 6.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-sb-admin-interface 0.7.0 - wagtail-sb-codefield 0.4.0 - wagtail-sb-fontawesome 0.3.0 - wagtail-sb-imageserializer =0.1.0, =0.1.0, =0.2....

wagtail-sb-admin-interface (0.7.0), wagtail-sb-codefield (0.4.0) +4 more potentially affected by unknown CVE via wagtail (6.0.0rc1)

wagtail PYPI version 6.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-sb-admin-interface 0.7.0 - wagtail-sb-codefield 0.4.0 - wagtail-sb-fontawesome 0.3.0 - wagtail-sb-imageserializer =0.1.0, =0.1.0, =0.2....

wagtail-sb-admin-interface (0.7.0), wagtail-sb-codefield (0.4.0) +4 more potentially affected by CVE-2026-55468 via wagtail (6.0.0rc1)

wagtail PYPI version 6.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-sb-admin-interface 0.7.0 - wagtail-sb-codefield 0.4.0 - wagtail-sb-fontawesome 0.3.0 - wagtail-sb-imageserializer =0.1.0, =0.1.0, =0.2....

GHSA-3VRH-M9W7-V94F Wagtail: Improper restriction handling on Pages admin API

Impact The internal Pages admin API incorrectly returns page fields without access control when they are declared in apifields. A user with access to the Wagtail admin can use this API to fetch draft and live page fields’ contents that are part of apifields on the base page model title, slug,...

coop (>=2.12.0, <=2.12.6), meine-stadt-transparent (0.2.12) +7 more potentially affected by CVE-2026-55468 via wagtail (2.12.6)

wagtail PYPI version 2.12.6 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - coop =2.12.0, =0.2.0, =0.10.2, =0.11.0 - wagtail-nav-menus 3.5.0 - wagtail-tag-manager 0.25.1 - wagtailstreamforms 3.14.0 Source cves:...

EUVD-2026-41150

Wagtail: Reflected XSS in dynamic image URL generator view...

Wagtail: Reflected XSS in dynamic image URL generator view

Impact A reflected cross-site scripting XSS vulnerability exists on the dynamic image URL generator view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could craft a URL that, when viewed by a user with higher privileges, could perform...

GHSA-23M2-MGHX-VQMF Wagtail: Reflected XSS in dynamic image URL generator view

Impact A reflected cross-site scripting XSS vulnerability exists on the dynamic image URL generator view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could craft a URL that, when viewed by a user with higher privileges, could perform...

wagtail-sb-admin-interface (0.7.0), wagtail-sb-codefield (0.4.0) +4 more potentially affected by CVE-2026-54262 via wagtail (6.0.0rc1)

wagtail PYPI version 6.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-sb-admin-interface 0.7.0 - wagtail-sb-codefield 0.4.0 - wagtail-sb-fontawesome 0.3.0 - wagtail-sb-imageserializer =0.1.0, =0.1.0, =0.2....

Wagtail: Improper permission handling in image preview

Impact Due to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin...