https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 01:15:09 +0000 https://cve.radiocsirt.org/vuln/cve-2026-44201 <p><strong>Affected:</strong> wagtail</p> <p>Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.</p> <p><strong>Affected:</strong> wagtail</p> <p>Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.</p> https://cve.radiocsirt.org/vuln/cve-2026-44201 https://cve.radiocsirt.org/vuln/ghsa-p5gm-92h4-6pv6 <p><strong>Affected:</strong> PyPI: wagtail</p> <p>### Impact</p> <p>The Documents and Images [API](https://docs.wagtail.org/en/stable/advanced_topics/api/index.html) incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections.</p> <p>### Patches</p> <p>Patched versions have been released as Wagtail 7.0.7 and 7.3.2. The new 7.4 LTS feature release also incorporates this fix.</p> <p>### Workarounds</p> <p>Site owners using Wagtail&#39;s API can avoid the vulnerability by adding [authentication](https://docs.wagtail.org/en/stable/advanced_topics/api/v2/configuration.html#authentication) to the Documents and Images APIs.</p> <p>### Acknowledgements</p> <p>Wagtail thanks independent security researcher Sanjok Karki @thesanjok for reporting this issue.</p> <p>### For more information If there are any questions or comments about this advisory:</p> <p>* Visit Wagtail&#39;s [support channels](https://docs.wagtail.org/en/stable/support.html) * Send an email to [security@wagtail.org](mailto:security@wagtail.org) (view the [security policy](https://github.com/wagtail/wagtail/security/policy) for more information).</p> <p><strong>Affected:</strong> PyPI: wagtail</p> <p>### Impact</p> <p>The Documents and Images [API](https://docs.wagtail.org/en/stable/advanced_topics/api/index.html) incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections.</p> <p>### Patches</p> <p>Patched versions have been released as Wagtail 7.0.7 and 7.3.2. The new 7.4 LTS feature release also incorporates this fix.</p> <p>### Workarounds</p> <p>Site owners using Wagtail&#39;s API can avoid the vulnerability by adding [authentication](https://docs.wagtail.org/en/stable/advanced_topics/api/v2/configuration.html#authentication) to the Documents and Images APIs.</p> <p>### Acknowledgements</p> <p>Wagtail thanks independent security researcher Sanjok Karki @thesanjok for reporting this issue.</p> <p>### For more information If there are any questions or comments about this advisory:</p> <p>* Visit Wagtail&#39;s [support channels](https://docs.wagtail.org/en/stable/support.html) * Send an email to [security@wagtail.org](mailto:security@wagtail.org) (view the [security policy](https://github.com/wagtail/wagtail/security/policy) for more information).</p> https://cve.radiocsirt.org/vuln/ghsa-p5gm-92h4-6pv6