Skip to contentMediawiki Mediawik vulnerabilities
- mediawiki, the wikimedia foundation mediawiki - charts extension +1 moreStored XSS in Wikimedia Chart pie tooltip via Data:*.tab field titleCVE-2026-143586.9 Medium
- mediawiki, the wikimedia foundation mediawiki - wikilambda extension +1 moreBlocked users can create and edit WikiLambda objectsCVE-2026-585176.9 Medium
- mediawiki, the wikimedia foundation mediawiki - urlshortener extension +1 moreUrlShortener defaults to ineffective validation open to third-party redirectsCVE-2026-585206.9 Medium
- mediawikiRemote Code Execution via Unsafe Deserialization in LogItem ImportCVE-2026-58025Public exploitFix available5.9 Medium
- mediawikiFull Account Takeover from BotPasswords and OAuth via action=changeauthenticationdataCVE-2026-58029Fix available5.3 Medium
- mediawiki, wikimedia foundation centralauth +1 morePretty-printed API output combined with centralauthtoken allows XSS with certain gadgetsCVE-2026-58028Fix available0.0 None
- mediawiki$wgNonincludableNamespaces can be bypassed by embedding redirect in other namespacesCVE-2026-58026Fix available0.0 None
- wikimedia foundation timeline, mediawiki +1 moreFull RCE using EasyTimeline ExtensionCVE-2026-88570.0 None
- wikimedia foundation timeline, mediawiki +1 moreStored XSS through javascript URLs in SVGs generated by EasyTimelineCVE-2026-580380.0 None
- wikimedia foundation abusefilter, mediawiki +1 moreQueryAbuseFilter API can be used to see the hit count of private filters, which is hidden in the UICVE-2026-58027Fix available5.3 Medium
- mediawiki, wikimedia foundation syntaxhighlight geshi +1 moreSyntaxHighlight stored XSS via unsanitized 'linelinks' attributeCVE-2026-58030Fix available5.3 Medium
- mediawikimw.Api.getErrorMessage() may return injected HTML if used without errorformat=htmlCVE-2026-58032Fix available5.3 Medium
- mediawiki"Total number of distinct authors" statistic at action=info does not exclude revisions where the author name was deletedCVE-2026-58033Fix available5.3 Medium
- mediawikiCore log entries for exceptions and XSS issues in log entry formatting code that may be caused by user-controlled inputCVE-2026-58037Fix available0.0 None
- mediawikiUsers API leaks whether privileged users have their user groups disabled for lack of 2FACVE-2026-580362.1 Low
- mediawikiAPI identification of users on private wikisCVE-2026-58024Fix available5.1 Medium
- cordea oauth, mediawiki +1 moreSession fixation attacks on improperly configured OAuth 1.0a toolsCVE-2026-137070.0 None
- wikimedia foundation urlshortener, mediawiki +1 moreUrlShortener extension url validation can be bypassed due to difference between php url parsing and WHATWGCVE-2026-137060.0 None
- mediawikiStored i18n XSS in Special:ApiSandbox when a deprecated module is selectedCVE-2026-580310.0 None
- wikimedia foundation checkuser, mediawiki +1 moreStored XSS through a system message when blocking a temporary account that's related to other temporary accountsCVE-2026-580340.0 None
- mediawikiStored XSS through a system message in the codex version of Special:BlockCVE-2026-580350.0 None
- mediawiki, the wikimedia foundation mediawiki - redirectmanager extension +1 moreCross-Site request forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki -...CVE-2026-585186.9 Medium
- mediawikiaction=raw with Special:Mypage subpage title responds with "Content-Type: text/html" on ctype=text/javascript requestCVE-2026-34095Fix available0.0 None
- mediawikiCustomized help link for page protection indicator is relative to subpage name, because the link target is missing the "/wiki/" prefixCVE-2026-34094Fix available2.0 Low
- mediawikiSpecial:UserRights allows viewing user rights from private wikiCVE-2026-34093Fix available1.1 Low
- mediawikiBlock UI elements in 'tools'-sidebar shows presence of an autoblocked IPCVE-2026-34092Fix available2.1 Low
- mediawikiUser localization leaked by AbuseFilter + EventStreamCVE-2026-34091Fix available5.5 Medium
- mediawikiRecentChanges entries expose suppressed content via generated log page htmlCVE-2026-34088Fix available1.3 Low
- wikimedia foundation oathauth, mediawiki +1 moreUsers API leaks whether privileged users have their user groups disabled for lack of 2FACVE-2026-34087Fix available5.1 Medium
- mediawikiTheoretical i18n XSS in mediawiki.page.preview.js when a page has multiple protection levelsCVE-2025-67483Fix available0.0 None
- mediawikiImporting leaks IP address of importer via EventStreamsCVE-2025-674761.3 Low
- mediawikiStored XSS through a system message in Special:ApiSandboxCVE-2025-67477Fix available0.0 None
- mediawikiCodexTablePager has i18n XSSCVE-2025-616450.0 None
- mediawikiStored XSS through system messages in MW CoreCVE-2025-61637Fix available0.0 None
- mediawikiStored XSS through system messages provided to CodexHtmlFormsCVE-2025-61642Fix available0.0 None
- mediawikiHTML rest endpoint needs PoolCounter and proper parser cache checkCVE-2025-61634Fix available0.0 None
- mediawikiCodex Special:Block vulnerable to message key XSSCVE-2025-61636Fix available0.0 None
- mediawikiAction API xslt option allows JavaScript execution by administrators who are not interface administratorsCVE-2025-67484Fix available0.0 None
- mediawikimw.message(…).parse() doesn't output safe HTML, but it's being used as if it doesCVE-2025-67481Fix available0.0 None
- mediawikilist=allrevisions can be used to bypass Extension:LockdownCVE-2025-67480Fix available0.0 None
- mediawikiStored XSS through edit summaries in MW CoreCVE-2025-67475Fix available0.0 None
- mediawikiWatchlist group mode reveals authors of edits with hidden authorshipCVE-2025-61646Fix available1.2 Low
- mediawikiEventStreams publishes suppressed recent change entries that are suppressed from their creationCVE-2025-61643Fix available2.7 Low
- mediawikiAPI list=allpages with maxsize is making really slow queriesCVE-2025-61641Fix available1.7 Low
- mediawikiStored XSS through system messages in Special:RecentChangesLinked (MW Core)CVE-2025-61640Fix available0.0 None
- mediawikiSuppressed blocked IP is visible in Special:BlockList, RC, and other placesCVE-2025-61639Fix available1.7 Low
- mediawiki, wikimedia parsoid +1 moreSanitizer::validateAttributes data-XSSCVE-2025-61638Public exploitFix available0.0 None
- mediawikiStored i18n XSS exposed by security patch for T402077CVE-2025-11261Fix available0.0 None
- mediawikiImproper permissions handling in MediaWiki AbuseFilterCVE-2024-47913Fix available5.3 Medium
- mediawikiAn issue was discovered in the Foreground skin for MediaWiki through 1.42.1. There is stored XSS...CVE-2024-40605Fix available4.8 Medium
- Show moreLoading…