Skip to contentWikimedia Foundation vulnerabilities
Newest
- wikimedia foundation timeline, mediawiki +1 moreFull RCE using EasyTimeline ExtensionCVE-2026-88570.0 None
- wikimedia foundation timeline, mediawiki +1 moreStored XSS through javascript URLs in SVGs generated by EasyTimelineCVE-2026-580380.0 None
- wikimedia foundation abusefilter, mediawiki +1 moreQueryAbuseFilter API can be used to see the hit count of private filters, which is hidden in the UICVE-2026-58027Fix available5.3 Medium
- mediawiki, wikimedia foundation syntaxhighlight geshi +1 moreSyntaxHighlight stored XSS via unsanitized 'linelinks' attributeCVE-2026-58030Fix available5.3 Medium
- mediawikimw.Api.getErrorMessage() may return injected HTML if used without errorformat=htmlCVE-2026-58032Fix available5.3 Medium
- mediawiki"Total number of distinct authors" statistic at action=info does not exclude revisions where the author name was deletedCVE-2026-58033Fix available5.3 Medium
- mediawikiCore log entries for exceptions and XSS issues in log entry formatting code that may be caused by user-controlled inputCVE-2026-58037Fix available0.0 None
- mediawikiUsers API leaks whether privileged users have their user groups disabled for lack of 2FACVE-2026-580362.1 Low
- mediawikiAPI identification of users on private wikisCVE-2026-58024Fix available5.1 Medium
- cordea oauth, mediawiki +1 moreSession fixation attacks on improperly configured OAuth 1.0a toolsCVE-2026-137070.0 None
- wikimedia foundation urlshortener, mediawiki +1 moreUrlShortener extension url validation can be bypassed due to difference between php url parsing and WHATWGCVE-2026-137060.0 None
- mediawikiStored i18n XSS in Special:ApiSandbox when a deprecated module is selectedCVE-2026-580310.0 None
- wikimedia foundation checkuser, mediawiki +1 moreStored XSS through a system message when blocking a temporary account that's related to other temporary accountsCVE-2026-580340.0 None
- mediawikiStored XSS through a system message in the codex version of Special:BlockCVE-2026-580350.0 None
- mediawiki cargo, the wikimedia foundation mediawiki - cargo extension +1 moreStored XSS through Cargo's map formatCVE-2026-585196.9 Medium
- labstack echoEcho: Encoded slash (%2F) bypasses route-level protection and exposes static filesCVE-2026-55677Fix available7.5 High
- wikimedia foundation echoExposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation...CVE-2026-5266Fix available2.3 Low
- mediawikiaction=raw with Special:Mypage subpage title responds with "Content-Type: text/html" on ctype=text/javascript requestCVE-2026-34095Fix available0.0 None
- mediawikiCustomized help link for page protection indicator is relative to subpage name, because the link target is missing the "/wiki/" prefixCVE-2026-34094Fix available2.0 Low
- mediawikiSpecial:UserRights allows viewing user rights from private wikiCVE-2026-34093Fix available1.1 Low
- mediawikiBlock UI elements in 'tools'-sidebar shows presence of an autoblocked IPCVE-2026-34092Fix available2.1 Low
- mediawikiUser localization leaked by AbuseFilter + EventStreamCVE-2026-34091Fix available5.5 Medium
- wikimedia scribuntoMemory leak in Scribunto causes runJobs.php to run out of memoryCVE-2026-340892.3 Low
- mediawikiRecentChanges entries expose suppressed content via generated log page htmlCVE-2026-34088Fix available1.3 Low
- wikimedia foundation oathauth, mediawiki +1 moreUsers API leaks whether privileged users have their user groups disabled for lack of 2FACVE-2026-34087Fix available5.1 Medium
- wikimedia foundation abusefilterAbuseFilter misuses ::userCanBitfield, exposing access-controlled informationCVE-2026-34086Fix available2.1 Low
- mediawiki cargo, wikimedia foundation mediawiki - cargo extension +1 moreStored XSS through the dynamic table format in CargoCVE-2026-398376.3 Medium
- mediawiki cargo, wikimedia foundation mediawiki - cargo extension +1 moreStored XSS through list fields on Cargo's page values and Special:CargoTablesCVE-2026-398416.3 Medium
- mediawiki cargo, wikimedia foundation mediawiki - cargo extension +1 moreCSS injection in multiple Cargo display formatsCVE-2026-398405.1 Medium
- mediawiki cargo, wikimedia foundation mediawiki - cargo extension +1 moreStored XSS through URLs in Cargo's map formatCVE-2026-398396.3 Medium
- wikimedia foundation mediawiki - proofreadpage extensionProofreadPage improperly sanitizes multiline styles using Sanitizer::checkCSSCVE-2026-398386.9 Medium
- wikimedia foundation mediawiki - reportincident extensionReportIncident DiscussionTools integration causes slow requestsCVE-2026-57625.3 Medium
- mediawiki checkuserSuggested investigations: Handle suppressed usernamesCVE-2026-340904.8 Medium
- labstack echoEcho has a Windows path traversal via backslash in middleware.Static default filesystemCVE-2026-25766Fix available5.3 Medium
- mediawikiTheoretical i18n XSS in mediawiki.page.preview.js when a page has multiple protection levelsCVE-2025-67483Fix available0.0 None
- mediawikiImporting leaks IP address of importer via EventStreamsCVE-2025-674761.3 Low
- mediawikiStored XSS through a system message in Special:ApiSandboxCVE-2025-67477Fix available0.0 None
- wikimedia foundation thanksUserInfoCard: Do permission checking when getting counts of global and local edits, new articles and thanksCVE-2025-61654Fix available0.0 None
- wikimedia foundation vectorImproper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')...CVE-2025-61657Fix available0.0 None
- mediawiki checkuserSpecial:GlobalContributions shows edits on wikis the viewer doesn't have access toCVE-2025-616581.3 Low
- wikimedia foundation discussiontoolsAction API discussiontoolspageinfo does not check for authorizeRead for the pageCVE-2025-61652Fix available2.7 Low
- mediawiki checkuseri18n XSS through Special:CheckUser CheckUser helperCVE-2025-616510.0 None
- mediawiki checkuserStored XSS through system messages in CheckUserCVE-2025-616480.0 None
- wikimedia foundation checkuserUserInfoCard: Check that performing user has permission to view log entries for number of past blocksCVE-2025-616491.1 Low
- wikimedia foundation checkuserUserInfoCard is vulnerable to message key stored XSSCVE-2025-616501.1 Low
- mediawikiCodexTablePager has i18n XSSCVE-2025-616450.0 None
- wikimedia foundation checkuserUserInfoCard: Don't allow access to information about users who are suppressed if you don't have suppressor rightsCVE-2025-616470.3 Low
- wikimedia foundation mediawikii18n XSS through Special:WatchlistCVE-2025-616440.0 None
- mediawikiStored XSS through system messages in MW CoreCVE-2025-61637Fix available0.0 None
- mediawikiStored XSS through system messages provided to CodexHtmlFormsCVE-2025-61642Fix available0.0 None
- Show moreLoading…