Skip to contentThe Wikimedia Foundation vulnerabilities
Newest
- the wikimedia foundation mediawiki mediasearch extensionattacker-controlled javascript license URL via XSSCVE-2026-103585Public exploit1.2 Low
- the wikimedia foundation mediawiki commonsmetadata extensionattacker-controlled javascript license URL via XSSCVE-2026-103584Public exploit1.1 Low
- the wikimedia foundation mediawiki pagetriage extensionpagetriagelist discloses suppressed reviewer usernamesCVE-2026-103440Public exploit1.2 Low
- the wikimedia foundation mediawiki wikbase extensionVarious rawParams() and escaped() updates to prevent XSS in Wikibase extensionCVE-2026-1034390.3 Low
- the wikimedia foundation mediawiki wikistories extensionVarious rawParams() and escaped() updates to prevent XSS in Wikistories extensionCVE-2026-1034380.3 Low
- the wikimedia foundation mediawiki readinglists extensionReadingLists imported metadata permits JavaScript URL XSSCVE-2026-103437Public exploit1.1 Low
- the wikimedia foundation mediawiki wikilambda extensionWikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragmentsCVE-2026-103446Public exploit7.4 High
- the wikimedia foundation mediawiki page forms extensionStored XSS through PageForms #autoedit redirect linksCVE-2026-103445Public exploit1.2 Low
- the wikimedia foundation mediawiki wikiforum extensionStored XSS through system messages in WikiForumCVE-2026-1034441.1 Low
- the wikimedia foundation mediawiki collection (book) extensionAPI permits session-seeded javascript URL XSSCVE-2026-1034431.1 Low
- the wikimedia foundation mediawiki centralauth extensionMergeAccount PHP object injection via session-key substitutionCVE-2026-103442Public exploit7.2 High
- the wikimedia foundation mediawiki wikibase extensionUnauthenticated arbitrary file deletion through Wikibase serialized entity parsingCVE-2026-103441Public exploit7.2 High
- the wikimedia foundation mediawiki - centralnotice extensionStored i18n XSSs in CentralNoticeCVE-2026-1030516.1 Medium
- the wikimedia foundation mediawiki - massmessage extensionStored i18n XSS in MassMessageCVE-2026-1030506.1 Medium
- the wikimedia foundation mediawiki - cargo extensionXSS in Cargo's Special:CargoQuery page due to unsanitized table headersCVE-2026-1030496.1 Medium
- the wikimedia foundation mediawiki - collection extensionOpen Redirect in Special:BookCVE-2026-1030486.1 Medium
- the wikimedia foundation mediawiki - centralauth extensionXSS through i18n message in CentralAuthCVE-2026-1030476.1 Medium
- the wikimedia foundation mediawiki - refreshed skinXSS in Refreshed skinCVE-2026-1030456.1 Medium
- the wikimedia foundation mediawiki - easytimeline extensionEasyTimeline should not serve image maps as application/xmlCVE-2026-1030449.8 Critical
- the wikimedia foundation mediawiki - wikilambda extensionWikifunctionsFragmentRenderer does unsafe string replacements on user-provided HTMLCVE-2026-1030466.1 Medium
- the wikimedia foundation mediawiki - wikibase extensionStored XSS on Wikibase Special:SetSiteLink via unescaped system messageCVE-2026-1002456.1 Medium
- the wikimedia foundation mediawiki - centralauth extensionCentralAuth exposes locally suppressed block information via globaluserinfo API and Special:CentralAuth (incomplete fix for CVE-2025-62669)CVE-2026-1002447.5 High
- the wikimedia foundation mediawiki - wikilambda extensionStored i18n XSS in WikiLambda's VisualEditor integrationCVE-2026-1003834.8 Medium
- the wikimedia foundation mediawiki - wikibase extensionReflected XSS in Wikibase Special:SetLabel language validationCVE-2026-100380Public exploit5.3 Medium
- the wikimedia foundation mediawiki - translate extensionMissing permission check in the Translate sandbox doRemind actionCVE-2026-1003785.3 Medium
- the wikimedia foundation mediawiki - wikilambda extensionRevision-deleted pages can be viewed through WikiLambda's action=edit and Special:ViewAbstractCVE-2026-1003776.9 Medium
- the wikimedia foundation mediawiki - flaggedrevs extension"Checked by" label in page history should not be shown if the underlying review log entry is suppressed"CVE-2026-968796.9 Medium
- the wikimedia foundation mediawiki - cargo extensionCargo Exhibit field alias allows stored XSSCVE-2026-96878Public exploit6.9 Medium
- the wikimedia foundation mediawiki - cargo extensionReflected XSS through Cargo Drilldown full-text searchCVE-2026-96877Public exploit6.9 Medium
- the wikimedia foundation mediawiki - cargo extensionAnonymous reflected XSS in CargoExport invalid-alias errorsCVE-2026-96876Public exploit6.9 Medium
- the wikimedia foundation mediawiki - cargo extensionReflected XSS in Cargo Drilldown hierarchy filtersCVE-2026-96875Public exploit6.9 Medium
- the wikimedia foundation mediawiki - thanks extensionStored i18n XSS in the Flow integration of ThanksCVE-2026-1002376.1 Medium
- the wikimedia foundation mediawiki - cargo extensionStored XSS in Cargo Drilldown tab namesCVE-2026-96874Public exploit2.3 Low
- the wikimedia foundation mediawiki - cirrussearch extensionReflected XSS in CirrusSearch debug explain outputCVE-2026-96873Public exploit5.5 Medium
- the wikimedia foundation mediawiki - wikilambda extensionWikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositionsCVE-2026-96872Public exploit2.9 Low
- mediawiki cargo, the wikimedia foundation mediawiki - cargo extension +1 moreCargo Extension: SQLi in Special:DrilldownCVE-2026-143636.9 Medium
- mediawiki, the wikimedia foundation mediawiki - charts extension +1 moreStored XSS in Wikimedia Chart pie tooltip via Data:*.tab field titleCVE-2026-143586.9 Medium
- mediawiki, the wikimedia foundation mediawiki - wikilambda extension +1 moreBlocked users can create and edit WikiLambda objectsCVE-2026-585176.9 Medium
- mediawiki cargo, the wikimedia foundation mediawiki - cargo extension +1 moreSQLi in Cargo extension via year range filterCVE-2026-585216.9 Medium
- mediawiki, the wikimedia foundation mediawiki - urlshortener extension +1 moreUrlShortener defaults to ineffective validation open to third-party redirectsCVE-2026-585206.9 Medium
- mediawiki cargo, the wikimedia foundation mediawiki - cargo extension +1 moreStored XSS through Cargo's map formatCVE-2026-585196.9 Medium
- mediawiki, the wikimedia foundation mediawiki - redirectmanager extension +1 moreCross-Site request forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki -...CVE-2026-585186.9 Medium
- the wikimedia foundation mediawiki - score extensionStored XSS in Score due to usage of non-reserved data attributesCVE-2026-399366.9 Medium
- the wikimedia foundation mediawiki - campaignevents extensionXSS-via-i18n in localised wiki namesCVE-2026-399356.9 Medium
- the wikimedia foundation mediawiki - growthexperiments extensionGrowth Experiments ReassignMenteesJob runs as an infinite loopCVE-2026-399346.9 Medium
- the wikimedia foundation mediawiki - globalwatchlist extensionMultiple XSS vulnerabilities in GlobalWatchlistCVE-2026-399336.9 Medium
- the wikimedia foundation mediawiki - centralauth extensionGlobal vanishing does not completely remove user emailCVE-2026-399378.8 High
- the wikimedia foundation mediawiki - wikilove extensionStored XSS through system messages in WikiLoveCVE-2026-227116.9 Medium
- the wikimedia foundation mediawiki - discussiontools extensionDiscussionTools should use better regexCVE-2025-11175Fix available8.8 High
- the wikimedia foundation mediawiki - campaignevents extension, wikimedia campaignevents +1 moreCampaignEvents API missing authorization exposes meeting and chat URLsCVE-2026-08175.3 Medium
- Show olderLoading…