Wikimedia Foundation vulnerabilities

Products

• Mediawiki 75
• Echo 20
• Mediawiki - Cargo Extension 14
• Checkuser 10
• Vector 5
• Abusefilter 3
• Mediawiki - Abusefilter Extension 3
• Mediawiki - Checkuser Extension 3
• Mediawiki - Css Extension 3
• Mediawiki - Securepoll Extension 3
• Mediawiki - Uploadwizard Extension 3
• Scribunto 3
• Mediawiki - Campaignevents Extension 2
• Mediawiki - Centralauth Extension 2
• Mediawiki - Datatransfer Extension 2
• Mediawiki - Flaggedrevs Extension 2
• Mediawiki - Ipinfo Extension 2
• Mediawiki - Mintydocs Extension 2
• Mediawiki - Proofreadpage Extension 2
• Mediawiki - Templatesandbox Extension 2
• Mediawiki - Urlshortener Extension 2
• Mediawiki - Wikibase Extension 2
• Mediawiki - Wikilambda Extension 2
• Oathauth 2
• Parsoid 2
• Timeline 2
• Visualeditor 2

Newest

• labstack echo Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto CVE-2026-118658 Fix available 4.7 MediumOctober 28, 2026
• labstack echo Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers CVE-2026-118657 Fix available 5.9 MediumOctober 28, 2026
• labstack echo Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI CVE-2026-118656 Fix available 6.1 MediumOctober 28, 2026
• labstack echo Echo: Static Middleware Double-Unescape Path Traversal CVE-2026-118655 Fix available 5.9 MediumOctober 28, 2026
• labstack echo Echo static file middleware route protection bypass via encoded dot-dot traversal CVE-2026-118654 Fix available 5.9 MediumOctober 28, 2026
• labstack echo Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration CVE-2026-118653 Fix available 5.3 MediumOctober 28, 2026
• labstack echo Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob CVE-2026-118652 Fix available 6.1 MediumOctober 28, 2026
• labstack echo Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default CVE-2026-118651 Fix available 5.3 MediumOctober 28, 2026
• labstack echo Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path CVE-2026-118650 Fix available 7.5 HighOctober 28, 2026
• labstack echo Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method CVE-2026-118266 Fix available 5.3 MediumOctober 28, 2026
• labstack echo Echo: X-Real-IP extractor trusts the header value instead of the sending peer CVE-2026-118265 Fix available 5.3 MediumOctober 23, 2026
• labstack echo Echo: WebSocket proxy can retain connections and handlers after client disconnect CVE-2026-118262 Fix available 8.2 HighOctober 23, 2026
• labstack echo Echo: Decompress permits unbounded gzip expansion in v4 CVE-2026-118261 Fix available 8.2 HighOctober 23, 2026
• labstack echo Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls CVE-2026-118264 Fix available 9.1 CriticalOctober 23, 2026
• labstack echo Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests CVE-2026-118263 Fix available 6.3 MediumOctober 23, 2026
• labstack echo Echo: BodyDump captures request and response bodies without size limits in v4 CVE-2026-118260 Fix available 8.2 HighOctober 23, 2026
• the wikimedia foundation mediawiki - cargo extension XSS in Cargo's Special:CargoQuery page due to unsanitized table headers CVE-2026-103049 6.1 MediumSeptember 29, 2026
• wikimedia foundation mediawiki - userpageviewtracker extension Unauthenticated SQL injection in UserPageViewTracker via filterusers and ignoreusers parameters CVE-2026-102796 7.5 HighSeptember 29, 2026
• the wikimedia foundation mediawiki - wikibase extension Stored XSS on Wikibase Special:SetSiteLink via unescaped system message CVE-2026-100245 6.1 MediumSeptember 29, 2026
• the wikimedia foundation mediawiki - centralauth extension CentralAuth exposes locally suppressed block information via globaluserinfo API and Special:CentralAuth (incomplete fix for CVE-2025-62669) CVE-2026-100244 7.5 HighSeptember 29, 2026
• wikimedia foundation mediawiki - wikiseo extension Stored XSS in WikiSEO author and image properties on action=info CVE-2026-100243 6.1 MediumSeptember 29, 2026
• wikimedia foundation mediawiki - datatransfer extension DataTransfer depends on phpspreadsheet version vulnerable to CVE-2026-59933 (XLS/OLE memory exhaustion) CVE-2026-100242 7.5 HighSeptember 29, 2026
• wikimedia foundation mediawiki - eventbus extension Private change tags exposed to anonymous users via revision-tags-change events CVE-2026-100241 7.5 HighSeptember 29, 2026
• wikimedia foundation mediawiki - templatesandbox extension TemplateSandbox does not check read permissions for the page being previewed CVE-2026-100240 9.1 CriticalSeptember 29, 2026
• wikimedia foundation mediawiki - flow extension Flow colon-separator and flow-guidedtour-optin-welcome-description messages allow stored XSS CVE-2026-100238 6.1 MediumSeptember 29, 2026
• the wikimedia foundation mediawiki - wikilambda extension Stored i18n XSS in WikiLambda's VisualEditor integration CVE-2026-100383 4.8 MediumSeptember 25, 2026
• wikimedia foundation mediawiki - externaldata extension Unauthenticated remote code execution through wikitext in ExternalData CVE-2026-100382 Public exploit 10.0 CriticalSeptember 25, 2026
• wikimedia foundation mediawiki - uploadwizard extension UploadWizard Flickr collection and set titles allow DOM XSS CVE-2026-100381 Public exploit 5.3 MediumSeptember 25, 2026
• the wikimedia foundation mediawiki - wikibase extension Reflected XSS in Wikibase Special:SetLabel language validation CVE-2026-100380 Public exploit 5.3 MediumSeptember 25, 2026
• wikimedia foundation wikipedia android app Cross-request disclosure of CentralAuth cookies in Wikipedia Android App CVE-2026-100379 5.3 MediumSeptember 25, 2026
• the wikimedia foundation mediawiki - translate extension Missing permission check in the Translate sandbox doRemind action CVE-2026-100378 5.3 MediumSeptember 25, 2026
• wikimedia foundation mediawiki - templatesandbox extension TemplateSandbox can be abused for XSS by asking another user to preview a page with a certain sandbox prefix CVE-2026-100376 4.8 MediumSeptember 25, 2026
• the wikimedia foundation mediawiki - wikilambda extension Revision-deleted pages can be viewed through WikiLambda's action=edit and Special:ViewAbstract CVE-2026-100377 6.9 MediumSeptember 25, 2026
• the wikimedia foundation mediawiki - flaggedrevs extension "Checked by" label in page history should not be shown if the underlying review log entry is suppressed" CVE-2026-96879 6.9 MediumSeptember 25, 2026
• the wikimedia foundation mediawiki - cargo extension Cargo Exhibit field alias allows stored XSS CVE-2026-96878 Public exploit 6.9 MediumSeptember 25, 2026
• the wikimedia foundation mediawiki - cargo extension Reflected XSS through Cargo Drilldown full-text search CVE-2026-96877 Public exploit 6.9 MediumSeptember 25, 2026
• the wikimedia foundation mediawiki - cargo extension Anonymous reflected XSS in CargoExport invalid-alias errors CVE-2026-96876 Public exploit 6.9 MediumSeptember 25, 2026
• the wikimedia foundation mediawiki - cargo extension Reflected XSS in Cargo Drilldown hierarchy filters CVE-2026-96875 Public exploit 6.9 MediumSeptember 25, 2026
• the wikimedia foundation mediawiki - cargo extension Stored XSS in Cargo Drilldown tab names CVE-2026-96874 Public exploit 2.3 LowSeptember 25, 2026
• vectordotdev vector Vector: Arbitrary file write in the file sink via templated path (path traversal). CVE-2026-77621 9.3 CriticalSeptember 22, 2026
• vectordotdev vector Vector: Unauthenticated denial of service in the `logstash` source via nested compressed frames (stack exhaustion and decompression amplification). CVE-2026-77620 8.7 HighSeptember 22, 2026
• vectordotdev vector Vector: Unauthenticated denial of service in the `logstash` source via unbounded memory allocation. CVE-2026-77619 8.7 HighSeptember 22, 2026
• mediawiki checkuser An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. Special... CVE-2023-37252 3.1 LowSeptember 14, 2026
• mediawiki cargo, the wikimedia foundation mediawiki - cargo extension +1 more Cargo Extension: SQLi in Special:Drilldown CVE-2026-14363 6.9 MediumJuly 1, 2026
• mediawiki cargo, the wikimedia foundation mediawiki - cargo extension +1 more SQLi in Cargo extension via year range filter CVE-2026-58521 6.9 MediumJuly 1, 2026
• mediawiki, the wikimedia foundation mediawiki - urlshortener extension +1 more UrlShortener defaults to ineffective validation open to third-party redirects CVE-2026-58520 6.9 MediumJuly 1, 2026
• mediawiki Remote Code Execution via Unsafe Deserialization in LogItem Import CVE-2026-58025 Public exploitFix available 5.9 MediumJuly 1, 2026
• mediawiki Full Account Takeover from BotPasswords and OAuth via action=changeauthenticationdata CVE-2026-58029 Fix available 5.3 MediumJuly 1, 2026
• mediawiki, wikimedia foundation centralauth +1 more Pretty-printed API output combined with centralauthtoken allows XSS with certain gadgets CVE-2026-58028 Fix available 0.0 NoneJuly 1, 2026
• mediawiki $wgNonincludableNamespaces can be bypassed by embedding redirect in other namespaces CVE-2026-58026 Fix available 0.0 NoneJuly 1, 2026
• Show olderLoading…