Login Request a demo
ME
Product
Mediawiki
by Mediawiki · last CVE Jul 1, 2026
417
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities417In the news0Timeline
Severity mix
Critical 20High 63Medium 198Low 3
Severity
All severities417Critical20High63Medium198Low3
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Mediawiki to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-58029
6.5
0%
Jul 1
Full Account Takeover from BotPasswords and OAuth via action=changeauthenticationdata
Affected: 1.43.0 before 1.43.9; 1.44.0 before 1.44.6; 1.45.0 before 1.45.4; 1.46.0
CVE-2026-58027
6.5
0%
Jul 1
QueryAbuseFilter API can be used to see the hit count of private filters, which is hidden in the UI
Affected: 1.43.0 before 1.43.9; 1.44.0 before 1.44.6; 1.45.0 before 1.45.4; 1.46.0
CVE-2026-58033
6.5
0%
Jul 1
"Total number of distinct authors" statistic at action=info does not exclude revisions where the author name was deleted
Affected: 1.43.0 before 1.43.9; 1.44.0 before 1.44.6; 1.45.0 before 1.45.4; 1.46.0
CVE-2025-67480
6.5
0%
Feb 3
list=allrevisions can be used to bypass Extension:Lockdown
Affected: 1.39.0 before 1.39.16; 1.43.0 before 1.43.6; 1.44.0 before 1.44.3; 1.45.0
CVE-2024-40601
6.5
0%
Jul 7
An issue was discovered in the MediaWikiChat extension for MediaWiki through 1.42.1
Affected: through 1.42.1
CVE-2023-45367
6.5
1%
Oct 9
An issue was discovered in the CheckUser extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1
Affected: before 1.35.12; 1.36.0 before 1.39.5; 1.40.0
CVE-2023-29139
6.5
1%
Mar 31
An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3
Affected: through 1.39.3
CVE-2021-46148
6.5
1%
Jan 10
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1
Affected: before 1.35.5; 1.36.0 before 1.36.3; 1.37.0 before 1.37.1
CVE-2021-44857
6.5
1%
Dec 17
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1
Affected: before 1.35.5; 1.36.0 before 1.36.3; 1.37.0 before 1.37.1
CVE-2021-42049
6.5
1%
Oct 6
An issue was discovered in the Translate extension in MediaWiki through 1.36.2
Affected: through 1.36.2
CVE-2021-31553
6.5
1%
Apr 22
An issue was discovered in the CheckUser extension for MediaWiki through 1.35.2
Affected: through 1.35.2
CVE-2021-31548
6.5
1%
Apr 22
An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2
Affected: through 1.35.2
CVE-2019-12470
6.5
1%
Jul 10
Wikimedia MediaWiki through 1.32.1 has Incorrect Access Control
Affected: before 1.27.6; 1.27.7 before 1.30.2; 1.31.0 before 1.31.2; 1.32.0 before 1.32.2
CVE-2019-12469
6.5
1%
Jul 10
MediaWiki through 1.32.1 has Incorrect Access Control
Affected: before 1.27.6; 1.27.7 before 1.30.2; 1.31.0 before 1.31.2; 1.32.0 before 1.32.2
CVE-2018-0505
6.5
2%
Oct 4
Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where BotPasswords can bypass CentralAuth's account lock
Affected: 1.31.0 before 1.31.1; 1.27.5; 1.29.3; 1.30.1
CVE-2018-0504
6.5
3%
Oct 4
Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains an information disclosure flaw in the Special:Redirect/logid
Affected: 1.31.0 before 1.31.1; 1.27.5; 1.29.3; 1.30.1
CVE-2017-0369
6.5
1%
Apr 13
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw, allowing a sysops to undelete pages, although the page is protected against it
Affected: 1.23.0 through 1.23.16; 1.27.0 before 1.27.2; 1.28.0 before 1.28.1
CVE-2012-4379
6.5
1%
Oct 19
MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not send a restrictive X-Frame-Options HTTP header, which allows remote attackers to conduct clickjacking attacks via an…
Affected: through 1.18.4; 1.19.0; 1.19.1
CVE-2016-6336
6.5
1%
Apr 20
MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote authenticated users with undelete permissions to bypass intended suppressrevision and…
Affected: through 1.23.14; 1.26.0; 1.26.1; 1.26.2; 1.26.3; 1.26.4; +1 more
CVE-2026-58518
6.3
0%
Jul 1
Cross-Site request forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - RedirectManager Extension allows Cross Site Request Forgery
Affected: before 1.3.3
CVE-2026-14358
6.1
0%
Jul 1
Stored XSS in Wikimedia Chart pie tooltip via Data:*.tab field title
Affected: 1.43.0 before 1.43.9; 1.44.0 before 1.44.6; 1.45.0 before 1.45.4
CVE-2026-58520
6.1
0%
Jul 1
UrlShortener defaults to ineffective validation open to third-party redirects
Affected: 1.43.0 before 1.43.9; 1.44.0 before 1.44.6; 1.45.0 before 1.45.4
CVE-2026-58038
6.1
0%
Jul 1
Stored XSS through javascript URLs in SVGs generated by EasyTimeline
Affected: 1.43.0 before 1.43.9; 1.44.0 before 1.44.6; 1.45.0 before 1.45.4; 1.46.0
CVE-2026-58030
6.1
0%
Jul 1
SyntaxHighlight stored XSS via unsanitized 'linelinks' attribute
Affected: 1.43.0 before 1.43.9; 1.44.0 before 1.44.6; 1.45.0 before 1.45.4; 1.46.0
CVE-2026-58032
6.1
0%
Jul 1
mw.Api.getErrorMessage() may return injected HTML if used without errorformat=html
Affected: 1.43.0 before 1.43.9; 1.44.0 before 1.44.6; 1.45.0 before 1.45.4; 1.46.0
CVE-2026-58037
6.1
0%
Jul 1
Core log entries for exceptions and XSS issues in log entry formatting code that may be caused by user-controlled input
Affected: 1.43.0 before 1.43.9; 1.44.0 before 1.44.6; 1.45.0 before 1.45.4; 1.46.0
CVE-2026-34095
6.1
0%
May 11
action=raw with Special:Mypage subpage title responds with "Content-Type: text/html" on ctype=text/javascript request
Affected: before 1.43.7; 1.44.0 before 1.44.4; 1.45.0 before 1.45.2
CVE-2025-67481
6.1
0%
Feb 3
mw.message(…).parse() doesn't output safe HTML, but it's being used as if it does
Affected: 1.39.0 before 1.39.16; 1.43.0 before 1.43.6; 1.44.0 before 1.44.3; 1.45.0
CVE-2025-67483
6.1
0%
Feb 3
Theoretical i18n XSS in mediawiki.page.preview.js when a page has multiple protection levels
Affected: 1.43.0 before 1.43.6; 1.44.0 before 1.44.3; 1.45.0
CVE-2025-67475
6.1
0%
Feb 3
Stored XSS through edit summaries in MW Core
Affected: 1.39.0 before 1.39.16; 1.43.0 before 1.43.6; 1.44.0 before 1.44.3; 1.45.0
CVE-2025-67477
6.1
0%
Feb 3
Stored XSS through a system message in Special:ApiSandbox
Affected: 1.44.0 before 1.44.3; 1.45.0
CVE-2025-11261
6.1
0%
Feb 3
Stored i18n XSS exposed by security patch for T402077
Affected: before 1.39.15; 1.43.0 before 1.43.5; 1.44.0 before 1.44.2
CVE-2025-61645
6.1
0%
Feb 3
CodexTablePager has i18n XSS
Affected: before 1.44.1
CVE-2025-61641
6.1
0%
Feb 2
API list=allpages with maxsize is making really slow queries
Affected: before 1.39.14; 1.43.0 before 1.43.4; 1.44.0
CVE-2025-61642
6.1
0%
Feb 2
Stored XSS through system messages provided to CodexHtmlForms
Affected: before 1.39.14; 1.43.0 before 1.43.4; 1.44.0
CVE-2025-61643
6.1
0%
Feb 2
EventStreams publishes suppressed recent change entries that are suppressed from their creation
Affected: before 1.39.14; 1.43.0 before 1.43.4; 1.44.0
CVE-2024-34500
6.1
0%
May 5
An issue was discovered in the UnlinkedWikibase extension in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1
Affected: before 1.39.6; 1.40.0 before 1.40.2; 1.41.0 before 1.41.1
CVE-2024-23179
6.1
0%
Jan 12
An issue was discovered in the GlobalBlocking extension in MediaWiki before 1.40.2
Affected: before 1.40.2
CVE-2024-23177
6.1
0%
Jan 12
An issue was discovered in the WatchAnalytics extension in MediaWiki before 1.40.2
Affected: before 1.40.2
CVE-2024-23173
6.1
0%
Jan 12
An issue was discovered in the Cargo extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2
Affected: before 1.35.14; 1.36.0 before 1.39.6; 1.40.0 before 1.40.2
CVE-2023-51704
6.1
1%
Dec 22
An issue was discovered in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2
Affected: before 1.35.14; 1.36.0 before 1.39.6; 1.40.0 before 1.40.2
CVE-2023-45373
6.1
0%
Oct 9
An issue was discovered in the ProofreadPage extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1
Affected: before 1.35.12; 1.36.0 before 1.39.5; 1.40.0
CVE-2023-37302
6.1
1%
Jun 30
An issue was discovered in SiteLinksView.php in Wikibase in MediaWiki through 1.39.3
Affected: through 1.39.3
CVE-2023-37256
6.1
0%
Jun 29
An issue was discovered in the Cargo extension for MediaWiki through 1.39.3
Affected: through 1.39.3
CVE-2023-37255
6.1
0%
Jun 29
An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3
Affected: through 1.39.3
CVE-2023-37254
6.1
0%
Jun 29
An issue was discovered in the Cargo extension for MediaWiki through 1.39.3
Affected: through 1.39.3
CVE-2023-37251
6.1
0%
Jun 29
An issue was discovered in the GoogleAnalyticsMetrics extension for MediaWiki through 1.39.3
Affected: through 1.39.3
CVE-2023-36675
6.1
1%
Jun 26
An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, and 1.39.x before 1.39.4
Affected: before 1.35.11; 1.36.0 before 1.38.7; 1.39.0 before 1.39.4
CVE-2023-22911
6.1
1%
Jan 10
An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1
Affected: before 1.35.9; 1.36.0 before 1.38.5; 1.39.0; 1.39.0; 1.39.0
CVE-2022-34912
6.1
1%
Jul 2
An issue was discovered in MediaWiki before 1.37.3 and 1.38.x before 1.38.1
Affected: before 1.37.3; 1.38.0; 1.38.0; 1.38.0
Page 1 of 4 · 198 total
12…4