Skip to contentWikimedia Foundation Mediawiki vulnerabilities
- the wikimedia foundation mediawiki - cargo extensionXSS in Cargo's Special:CargoQuery page due to unsanitized table headersCVE-2026-1030496.1 Medium
- wikimedia foundation mediawiki - userpageviewtracker extensionUnauthenticated SQL injection in UserPageViewTracker via filterusers and ignoreusers parametersCVE-2026-1027967.5 High
- the wikimedia foundation mediawiki - wikibase extensionStored XSS on Wikibase Special:SetSiteLink via unescaped system messageCVE-2026-1002456.1 Medium
- the wikimedia foundation mediawiki - centralauth extensionCentralAuth exposes locally suppressed block information via globaluserinfo API and Special:CentralAuth (incomplete fix for CVE-2025-62669)CVE-2026-1002447.5 High
- wikimedia foundation mediawiki - wikiseo extensionStored XSS in WikiSEO author and image properties on action=infoCVE-2026-1002436.1 Medium
- wikimedia foundation mediawiki - datatransfer extensionDataTransfer depends on phpspreadsheet version vulnerable to CVE-2026-59933 (XLS/OLE memory exhaustion)CVE-2026-1002427.5 High
- wikimedia foundation mediawiki - eventbus extensionPrivate change tags exposed to anonymous users via revision-tags-change eventsCVE-2026-1002417.5 High
- wikimedia foundation mediawiki - templatesandbox extensionTemplateSandbox does not check read permissions for the page being previewedCVE-2026-1002409.1 Critical
- wikimedia foundation mediawiki - flow extensionFlow colon-separator and flow-guidedtour-optin-welcome-description messages allow stored XSSCVE-2026-1002386.1 Medium
- the wikimedia foundation mediawiki - wikilambda extensionStored i18n XSS in WikiLambda's VisualEditor integrationCVE-2026-1003834.8 Medium
- wikimedia foundation mediawiki - externaldata extensionUnauthenticated remote code execution through wikitext in ExternalDataCVE-2026-100382Public exploit10.0 Critical
- wikimedia foundation mediawiki - uploadwizard extensionUploadWizard Flickr collection and set titles allow DOM XSSCVE-2026-100381Public exploit5.3 Medium
- the wikimedia foundation mediawiki - wikibase extensionReflected XSS in Wikibase Special:SetLabel language validationCVE-2026-100380Public exploit5.3 Medium
- the wikimedia foundation mediawiki - translate extensionMissing permission check in the Translate sandbox doRemind actionCVE-2026-1003785.3 Medium
- wikimedia foundation mediawiki - templatesandbox extensionTemplateSandbox can be abused for XSS by asking another user to preview a page with a certain sandbox prefixCVE-2026-1003764.8 Medium
- the wikimedia foundation mediawiki - wikilambda extensionRevision-deleted pages can be viewed through WikiLambda's action=edit and Special:ViewAbstractCVE-2026-1003776.9 Medium
- the wikimedia foundation mediawiki - flaggedrevs extension"Checked by" label in page history should not be shown if the underlying review log entry is suppressed"CVE-2026-968796.9 Medium
- the wikimedia foundation mediawiki - cargo extensionCargo Exhibit field alias allows stored XSSCVE-2026-96878Public exploit6.9 Medium
- the wikimedia foundation mediawiki - cargo extensionReflected XSS through Cargo Drilldown full-text searchCVE-2026-96877Public exploit6.9 Medium
- the wikimedia foundation mediawiki - cargo extensionAnonymous reflected XSS in CargoExport invalid-alias errorsCVE-2026-96876Public exploit6.9 Medium
- the wikimedia foundation mediawiki - cargo extensionReflected XSS in Cargo Drilldown hierarchy filtersCVE-2026-96875Public exploit6.9 Medium
- the wikimedia foundation mediawiki - cargo extensionStored XSS in Cargo Drilldown tab namesCVE-2026-96874Public exploit2.3 Low
- mediawiki cargo, the wikimedia foundation mediawiki - cargo extension +1 moreCargo Extension: SQLi in Special:DrilldownCVE-2026-143636.9 Medium
- mediawiki cargo, the wikimedia foundation mediawiki - cargo extension +1 moreSQLi in Cargo extension via year range filterCVE-2026-585216.9 Medium
- mediawiki, the wikimedia foundation mediawiki - urlshortener extension +1 moreUrlShortener defaults to ineffective validation open to third-party redirectsCVE-2026-585206.9 Medium
- mediawikiRemote Code Execution via Unsafe Deserialization in LogItem ImportCVE-2026-58025Public exploitFix available5.9 Medium
- mediawikiFull Account Takeover from BotPasswords and OAuth via action=changeauthenticationdataCVE-2026-58029Fix available5.3 Medium
- mediawiki, wikimedia foundation centralauth +1 morePretty-printed API output combined with centralauthtoken allows XSS with certain gadgetsCVE-2026-58028Fix available0.0 None
- mediawiki$wgNonincludableNamespaces can be bypassed by embedding redirect in other namespacesCVE-2026-58026Fix available0.0 None
- mediawikimw.Api.getErrorMessage() may return injected HTML if used without errorformat=htmlCVE-2026-58032Fix available5.3 Medium
- mediawiki"Total number of distinct authors" statistic at action=info does not exclude revisions where the author name was deletedCVE-2026-58033Fix available5.3 Medium
- mediawikiCore log entries for exceptions and XSS issues in log entry formatting code that may be caused by user-controlled inputCVE-2026-58037Fix available0.0 None
- mediawikiUsers API leaks whether privileged users have their user groups disabled for lack of 2FACVE-2026-580362.1 Low
- mediawikiAPI identification of users on private wikisCVE-2026-58024Fix available5.1 Medium
- mediawikiStored i18n XSS in Special:ApiSandbox when a deprecated module is selectedCVE-2026-580310.0 None
- mediawikiStored XSS through a system message in the codex version of Special:BlockCVE-2026-580350.0 None
- mediawiki cargo, the wikimedia foundation mediawiki - cargo extension +1 moreStored XSS through Cargo's map formatCVE-2026-585196.9 Medium
- mediawikiaction=raw with Special:Mypage subpage title responds with "Content-Type: text/html" on ctype=text/javascript requestCVE-2026-34095Fix available0.0 None
- mediawikiCustomized help link for page protection indicator is relative to subpage name, because the link target is missing the "/wiki/" prefixCVE-2026-34094Fix available2.0 Low
- mediawikiSpecial:UserRights allows viewing user rights from private wikiCVE-2026-34093Fix available1.1 Low
- mediawikiBlock UI elements in 'tools'-sidebar shows presence of an autoblocked IPCVE-2026-34092Fix available2.1 Low
- mediawikiUser localization leaked by AbuseFilter + EventStreamCVE-2026-34091Fix available5.5 Medium
- mediawikiRecentChanges entries expose suppressed content via generated log page htmlCVE-2026-34088Fix available1.3 Low
- mediawiki cargo, wikimedia foundation mediawiki - cargo extension +1 moreStored XSS through the dynamic table format in CargoCVE-2026-398376.3 Medium
- mediawiki cargo, wikimedia foundation mediawiki - cargo extension +1 moreStored XSS through list fields on Cargo's page values and Special:CargoTablesCVE-2026-398416.3 Medium
- mediawiki cargo, wikimedia foundation mediawiki - cargo extension +1 moreCSS injection in multiple Cargo display formatsCVE-2026-398405.1 Medium
- mediawiki cargo, wikimedia foundation mediawiki - cargo extension +1 moreStored XSS through URLs in Cargo's map formatCVE-2026-398396.3 Medium
- wikimedia foundation mediawiki - proofreadpage extensionProofreadPage improperly sanitizes multiline styles using Sanitizer::checkCSSCVE-2026-398386.9 Medium
- wikimedia foundation mediawiki - reportincident extensionReportIncident DiscussionTools integration causes slow requestsCVE-2026-57625.3 Medium
- mediawikiTheoretical i18n XSS in mediawiki.page.preview.js when a page has multiple protection levelsCVE-2025-67483Fix available0.0 None
- Show olderLoading…