Skip to content
Mediawiki vulnerabilities
Newest
-
mediawiki massmessage
An issue was discovered in the MassMessage extension in MediaWiki before 1.40.2. For a Special...
CVE-2024-23176
5.4 Medium
-
mediawiki proofreadpage
An issue was discovered in the ProofreadPage extension for MediaWiki through 1.39.3. It leaks...
CVE-2023-37253
3.1 Low
-
mediawiki checkuser
An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. Special...
CVE-2023-37252
3.1 Low
-
mediawiki cargo, the wikimedia foundation mediawiki - cargo extension +1 more
Cargo Extension: SQLi in Special:Drilldown
CVE-2026-14363
6.9 Medium
-
mediawiki, the wikimedia foundation mediawiki - charts extension +1 more
Stored XSS in Wikimedia Chart pie tooltip via Data:*.tab field title
CVE-2026-14358
6.9 Medium
-
mediawiki, the wikimedia foundation mediawiki - wikilambda extension +1 more
Blocked users can create and edit WikiLambda objects
CVE-2026-58517
6.9 Medium
-
mediawiki cargo, the wikimedia foundation mediawiki - cargo extension +1 more
SQLi in Cargo extension via year range filter
CVE-2026-58521
6.9 Medium
-
mediawiki, the wikimedia foundation mediawiki - urlshortener extension +1 more
UrlShortener defaults to ineffective validation open to third-party redirects
CVE-2026-58520
6.9 Medium
-
mediawiki
Remote Code Execution via Unsafe Deserialization in LogItem Import
CVE-2026-58025
Public exploitFix available
5.9 Medium
-
mediawiki
Full Account Takeover from BotPasswords and OAuth via action=changeauthenticationdata
CVE-2026-58029
Fix available
5.3 Medium
-
mediawiki, wikimedia foundation centralauth +1 more
Pretty-printed API output combined with centralauthtoken allows XSS with certain gadgets
CVE-2026-58028
Fix available
0.0 None
-
mediawiki
$wgNonincludableNamespaces can be bypassed by embedding redirect in other namespaces
CVE-2026-58026
Fix available
0.0 None
-
wikimedia foundation timeline, mediawiki +1 more
Full RCE using EasyTimeline Extension
CVE-2026-8857
0.0 None
-
wikimedia foundation timeline, mediawiki +1 more
Stored XSS through javascript URLs in SVGs generated by EasyTimeline
CVE-2026-58038
0.0 None
-
wikimedia foundation abusefilter, mediawiki +1 more
QueryAbuseFilter API can be used to see the hit count of private filters, which is hidden in the UI
CVE-2026-58027
Fix available
5.3 Medium
-
mediawiki, wikimedia foundation syntaxhighlight geshi +1 more
SyntaxHighlight stored XSS via unsanitized 'linelinks' attribute
CVE-2026-58030
Fix available
5.3 Medium
-
mediawiki
mw.Api.getErrorMessage() may return injected HTML if used without errorformat=html
CVE-2026-58032
Fix available
5.3 Medium
-
mediawiki
"Total number of distinct authors" statistic at action=info does not exclude revisions where the author name was deleted
CVE-2026-58033
Fix available
5.3 Medium
-
mediawiki
Core log entries for exceptions and XSS issues in log entry formatting code that may be caused by user-controlled input
CVE-2026-58037
Fix available
0.0 None
-
mediawiki
Users API leaks whether privileged users have their user groups disabled for lack of 2FA
CVE-2026-58036
2.1 Low
-
mediawiki
API identification of users on private wikis
CVE-2026-58024
Fix available
5.1 Medium
-
cordea oauth, mediawiki +1 more
Session fixation attacks on improperly configured OAuth 1.0a tools
CVE-2026-13707
0.0 None
-
wikimedia foundation urlshortener, mediawiki +1 more
UrlShortener extension url validation can be bypassed due to difference between php url parsing and WHATWG
CVE-2026-13706
0.0 None
-
mediawiki
Stored i18n XSS in Special:ApiSandbox when a deprecated module is selected
CVE-2026-58031
0.0 None
-
wikimedia foundation checkuser, mediawiki +1 more
Stored XSS through a system message when blocking a temporary account that's related to other temporary accounts
CVE-2026-58034
0.0 None
-
mediawiki
Stored XSS through a system message in the codex version of Special:Block
CVE-2026-58035
0.0 None
-
mediawiki cargo, the wikimedia foundation mediawiki - cargo extension +1 more
Stored XSS through Cargo's map format
CVE-2026-58519
6.9 Medium
-
mediawiki, the wikimedia foundation mediawiki - redirectmanager extension +1 more
Cross-Site request forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki -...
CVE-2026-58518
6.9 Medium
-
mediawiki
action=raw with Special:Mypage subpage title responds with "Content-Type: text/html" on ctype=text/javascript request
CVE-2026-34095
Fix available
0.0 None
-
mediawiki
Customized help link for page protection indicator is relative to subpage name, because the link target is missing the "/wiki/" prefix
CVE-2026-34094
Fix available
2.0 Low
-
mediawiki
Special:UserRights allows viewing user rights from private wiki
CVE-2026-34093
Fix available
1.1 Low
-
mediawiki
Block UI elements in 'tools'-sidebar shows presence of an autoblocked IP
CVE-2026-34092
Fix available
2.1 Low
-
mediawiki
User localization leaked by AbuseFilter + EventStream
CVE-2026-34091
Fix available
5.5 Medium
-
mediawiki
RecentChanges entries expose suppressed content via generated log page html
CVE-2026-34088
Fix available
1.3 Low
-
wikimedia foundation oathauth, mediawiki +1 more
Users API leaks whether privileged users have their user groups disabled for lack of 2FA
CVE-2026-34087
Fix available
5.1 Medium
-
mediawiki cargo, wikimedia foundation mediawiki - cargo extension +1 more
Stored XSS through the dynamic table format in Cargo
CVE-2026-39837
6.3 Medium
-
mediawiki cargo, wikimedia foundation mediawiki - cargo extension +1 more
Stored XSS through list fields on Cargo's page values and Special:CargoTables
CVE-2026-39841
6.3 Medium
-
mediawiki cargo, wikimedia foundation mediawiki - cargo extension +1 more
CSS injection in multiple Cargo display formats
CVE-2026-39840
5.1 Medium
-
mediawiki cargo, wikimedia foundation mediawiki - cargo extension +1 more
Stored XSS through URLs in Cargo's map format
CVE-2026-39839
6.3 Medium
-
mediawiki checkuser
Suggested investigations: Handle suppressed usernames
CVE-2026-34090
4.8 Medium
-
mediawiki
Theoretical i18n XSS in mediawiki.page.preview.js when a page has multiple protection levels
CVE-2025-67483
Fix available
0.0 None
-
mediawiki
Importing leaks IP address of importer via EventStreams
CVE-2025-67476
1.3 Low
-
mediawiki
Stored XSS through a system message in Special:ApiSandbox
CVE-2025-67477
Fix available
0.0 None
-
mediawiki checkuser
Special:GlobalContributions shows edits on wikis the viewer doesn't have access to
CVE-2025-61658
1.3 Low
-
mediawiki checkuser
i18n XSS through Special:CheckUser CheckUser helper
CVE-2025-61651
0.0 None
-
mediawiki checkuser
Stored XSS through system messages in CheckUser
CVE-2025-61648
0.0 None
-
mediawiki
CodexTablePager has i18n XSS
CVE-2025-61645
0.0 None
-
mediawiki
Stored XSS through system messages in MW Core
CVE-2025-61637
Fix available
0.0 None
-
mediawiki
Stored XSS through system messages provided to CodexHtmlForms
CVE-2025-61642
Fix available
0.0 None
-
mediawiki
HTML rest endpoint needs PoolCounter and proper parser cache check
CVE-2025-61634
Fix available
0.0 None
- Show olderLoading…