torchbox records

23 published records for vendor torchbox.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 100%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

23 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
29Monitor	CVE-2026-54263No exploit	Wagtail: Reflected XSS in dynamic image URL generator viewtorchbox · wagtail · CWE-79 XSS	High7.3	—	0.4%	Jul 1, 2026
27Monitor	CVE-2020-11001No exploit	Possible XSS attack in Wagtailtorchbox · wagtail · CWE-79 XSS	Medium6.8	—	1.3%	Apr 14, 2020
26Monitor	CVE-2026-44197No exploit	Wagtail: Improper permission handling when comparing revisionstorchbox · wagtail · CWE-280	Medium6.5	—	0.3%	May 11, 2026
26Monitor	CVE-2026-54261No exploit	Wagtail: Improper permission handling in image previewtorchbox · wagtail · CWE-280	Medium6.5	—	0.3%	Jul 1, 2026
26Monitor	CVE-2026-44200No exploit	Wagtail: Improper permission handling when copying pagestorchbox · wagtail · CWE-280	Medium6.5	—	0.3%	May 11, 2026
26Monitor	CVE-2026-44199No exploit	Wagtail: Improper permission handling when deleting form submissionstorchbox · wagtail · CWE-280	Medium6.5	—	0.3%	May 11, 2026
24Monitor	CVE-2026-28222No exploit	Wagtail: Improper escaping of HTML (Cross-site Scripting) on TableBlock class attributestorchbox · wagtail · CWE-79 XSS	Medium6.1	—	0.6%	Mar 5, 2026
24Monitor	CVE-2026-28223No exploit	Wagtail: Improper escaping of HTML (Cross-site Scripting) in simple_translation admin interfacetorchbox · wagtail · CWE-79 XSS	Medium6.1	—	0.6%	Mar 5, 2026
21Monitor	CVE-2021-32681No exploit	Improper escaping of HTML ('Cross-site Scripting') in Wagtail StreamField blockstorchbox · wagtail · CWE-79 XSS	Medium5.4	—	1.1%	Jun 17, 2021
21Monitor	CVE-2020-15118No exploit	Cross-Site Scripting in Wagtailtorchbox · wagtail · CWE-79 XSS	Medium5.4	—	1.1%	Jul 20, 2020
21Monitor	CVE-2023-28836No exploit	Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin viewstorchbox · wagtail · CWE-79 XSS	Medium5.4	—	0.8%	Apr 3, 2023
21Monitor	CVE-2026-44201No exploit	Wagtail: Improper restriction handling on Documents and Images APItorchbox · wagtail · CWE-280 Pre-auth	Medium5.3	—	0.3%	May 11, 2026
20Monitor	CVE-2026-25517No exploit	Wagtail has improper permission handling on admin preview endpointstorchbox · wagtail · CWE-862 Broken access control (IDOR)	Medium5.1	—	0.4%	Feb 4, 2026
19Monitor	CVE-2023-28837No exploit	Wagtail vulnerable to denial-of-service via memory exhaustion when uploading large filestorchbox · wagtail · CWE-400 Denial of service	Medium4.9	—	1.1%	Apr 3, 2023
19Monitor	CVE-2021-29434No exploit	Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fieldstorchbox · wagtail · CWE-79 RCE XSS	Medium4.8	—	0.6%	Apr 19, 2021
19Monitor	CVE-2024-39317No exploit	Wagtail regular expression denial-of-service via search query parsingtorchbox · wagtail · CWE-1333 Denial of service	Medium4.9	—	0.6%	Jul 11, 2024
18Monitor	CVE-2020-11037No exploit	Potential Observable Timing Discrepancy in Wagtailtorchbox · wagtail · CWE-208	Medium4.7	—	0.3%	Apr 30, 2020
17Monitor	CVE-2022-21683No exploit	Comment reply notifications sent to incorrect users in wagtailtorchbox · wagtail · CWE-200 Info leak	Medium4.3	—	1.0%	Jan 18, 2022
17Monitor	CVE-2026-54259No exploit	Wagtail: Improper restriction handling on Documents and Images chosen endpointstorchbox · wagtail · CWE-280	Medium4.3	—	0.3%	Jul 1, 2026
17Monitor	CVE-2026-44198No exploit	Wagtail: Improper permission handling when viewing page historytorchbox · wagtail · CWE-280	Medium4.3	—	0.3%	May 11, 2026
17Monitor	CVE-2026-54262No exploit	Wagtail: Pages translations can be created without page permissions when using simple_translationtorchbox · wagtail · CWE-280	Medium4.3	—	0.3%	Jul 1, 2026
10Monitor	CVE-2023-45809No exploit	Disclosure of user names via admin bulk action views in wagtailtorchbox · wagtail · CWE-200 Info leak	Low2.7	—	0.5%	Oct 19, 2023
10Monitor	CVE-2026-54260No exploit	Wagtail: Denial of service via unbounded filter specs in the image previewtorchbox · wagtail · CWE-400 Denial of service	Low2.7	—	0.4%	Jul 1, 2026

CVE-2026-54263
29Monitor
Wagtail: Reflected XSS in dynamic image URL generator view
HighCVSS 7.3No exploitEPSS 0%
- XSS
torchbox · wagtailJul 1, 2026
CVE-2020-11001
27Monitor
Possible XSS attack in Wagtail
MediumCVSS 6.8No exploitEPSS 1%
- XSS
torchbox · wagtailApr 14, 2020
CVE-2026-44197
26Monitor
Wagtail: Improper permission handling when comparing revisions
MediumCVSS 6.5No exploitEPSS 0%
torchbox · wagtailMay 11, 2026
CVE-2026-54261
26Monitor
Wagtail: Improper permission handling in image preview
MediumCVSS 6.5No exploitEPSS 0%
torchbox · wagtailJul 1, 2026
CVE-2026-44200
26Monitor
Wagtail: Improper permission handling when copying pages
MediumCVSS 6.5No exploitEPSS 0%
torchbox · wagtailMay 11, 2026
CVE-2026-44199
26Monitor
Wagtail: Improper permission handling when deleting form submissions
MediumCVSS 6.5No exploitEPSS 0%
torchbox · wagtailMay 11, 2026
CVE-2026-28222
24Monitor
Wagtail: Improper escaping of HTML (Cross-site Scripting) on TableBlock class attributes
MediumCVSS 6.1No exploitEPSS 1%
- XSS
torchbox · wagtailMar 5, 2026
CVE-2026-28223
24Monitor
Wagtail: Improper escaping of HTML (Cross-site Scripting) in simple_translation admin interface
MediumCVSS 6.1No exploitEPSS 1%
- XSS
torchbox · wagtailMar 5, 2026
CVE-2021-32681
21Monitor
Improper escaping of HTML ('Cross-site Scripting') in Wagtail StreamField blocks
MediumCVSS 5.4No exploitEPSS 1%
- XSS
torchbox · wagtailJun 17, 2021
CVE-2020-15118
21Monitor
Cross-Site Scripting in Wagtail
MediumCVSS 5.4No exploitEPSS 1%
- XSS
torchbox · wagtailJul 20, 2020
CVE-2023-28836
21Monitor
Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views
MediumCVSS 5.4No exploitEPSS 1%
- XSS
torchbox · wagtailApr 3, 2023
CVE-2026-44201
21Monitor
Wagtail: Improper restriction handling on Documents and Images API
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
torchbox · wagtailMay 11, 2026
CVE-2026-25517
20Monitor
Wagtail has improper permission handling on admin preview endpoints
MediumCVSS 5.1No exploitEPSS 0%
- Broken access control (IDOR)
torchbox · wagtailFeb 4, 2026
CVE-2023-28837
19Monitor
Wagtail vulnerable to denial-of-service via memory exhaustion when uploading large files
MediumCVSS 4.9No exploitEPSS 1%
- Denial of service
torchbox · wagtailApr 3, 2023
CVE-2021-29434
19Monitor
Improper validation of URLs ('Cross-site Scripting') in Wagtail rich text fields
MediumCVSS 4.8No exploitEPSS 1%
- RCE
- XSS
torchbox · wagtailApr 19, 2021
CVE-2024-39317
19Monitor
Wagtail regular expression denial-of-service via search query parsing
MediumCVSS 4.9No exploitEPSS 1%
- Denial of service
torchbox · wagtailJul 11, 2024
CVE-2020-11037
18Monitor
Potential Observable Timing Discrepancy in Wagtail
MediumCVSS 4.7No exploitEPSS 0%
torchbox · wagtailApr 30, 2020
CVE-2022-21683
17Monitor
Comment reply notifications sent to incorrect users in wagtail
MediumCVSS 4.3No exploitEPSS 1%
- Info leak
torchbox · wagtailJan 18, 2022
CVE-2026-54259
17Monitor
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
MediumCVSS 4.3No exploitEPSS 0%
torchbox · wagtailJul 1, 2026
CVE-2026-44198
17Monitor
Wagtail: Improper permission handling when viewing page history
MediumCVSS 4.3No exploitEPSS 0%
torchbox · wagtailMay 11, 2026
CVE-2026-54262
17Monitor
Wagtail: Pages translations can be created without page permissions when using simple_translation
MediumCVSS 4.3No exploitEPSS 0%
torchbox · wagtailJul 1, 2026
CVE-2023-45809
10Monitor
Disclosure of user names via admin bulk action views in wagtail
LowCVSS 2.7No exploitEPSS 0%
- Info leak
torchbox · wagtailOct 19, 2023
CVE-2026-54260
10Monitor
Wagtail: Denial of service via unbounded filter specs in the image preview
LowCVSS 2.7No exploitEPSS 0%
- Denial of service
torchbox · wagtailJul 1, 2026