Login Request a demo
CA
Product
Cargo
by Mediawiki · last CVE Jul 1, 2026
10
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities10In the news0Timeline
Severity mix
Critical 3High 1Medium 6Low 0
Severity
All severities10Critical3High1Medium6Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Cargo to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-14363
9.8
1%
Jul 1
Cargo Extension: SQLi in Special:Drilldown
Affected: before 3.9.1
CVE-2026-58521
9.8
1%
Jul 1
SQLi in Cargo extension via year range filter
Affected: before 3.9.1
CVE-2024-47849
9.8
1%
Oct 5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows SQL Injection.This issue…
Affected: 3.6.0
CVE-2024-47846
8.8
0%
Oct 5
Cross-Site Request Forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross Site Request Forgery.This issue affects Mediawiki - Cargo: from 3.6.X…
Affected: 3.6.0
CVE-2026-39841
6.1
0%
Apr 7
Stored XSS through list fields on Cargo's page values and Special:CargoTables
Affected: before 3.8.7
CVE-2026-39840
6.1
0%
Apr 7
CSS injection in multiple Cargo display formats
Affected: before 3.8.7
CVE-2026-39839
6.1
0%
Apr 7
Stored XSS through URLs in Cargo's map format
Affected: before 3.8.7
CVE-2024-47847
6.1
0%
Oct 5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross-Site Scripting…
Affected: 3.6.0
CVE-2026-58519
5.4
0%
Jul 1
Stored XSS through Cargo's map format
Affected: before 3.9.1
CVE-2026-39837
5.4
0%
Apr 7
Stored XSS through the dynamic table format in Cargo
Affected: before 3.8.7
Showing 10