Remote Code Execution via Unsafe Deserialization in LogItem Import

Action API xslt option allows JavaScript execution by administrators who are not interface administrators

Users API leaks whether privileged users have their user groups disabled for lack of 2FA

Block UI elements in 'tools'-sidebar shows presence of an autoblocked IP

User localization leaked by AbuseFilter + EventStream

RecentChanges entries expose suppressed content via generated log page html

Full Account Takeover from BotPasswords and OAuth via action=changeauthenticationdata

"Total number of distinct authors" statistic at action=info does not exclude revisions where the author name was deleted

list=allrevisions can be used to bypass Extension:Lockdown

mw.Api.getErrorMessage() may return injected HTML if used without errorformat=html

Core log entries for exceptions and XSS issues in log entry formatting code that may be caused by user-controlled input

action=raw with Special:Mypage subpage title responds with "Content-Type: text/html" on ctype=text/javascript request

mw.message(…).parse() doesn't output safe HTML, but it's being used as if it does

Theoretical i18n XSS in mediawiki.page.preview.js when a page has multiple protection levels

Stored XSS through edit summaries in MW Core

Stored XSS through a system message in Special:ApiSandbox

Stored i18n XSS exposed by security patch for T402077

CodexTablePager has i18n XSS

API list=allpages with maxsize is making really slow queries

Stored XSS through system messages provided to CodexHtmlForms

EventStreams publishes suppressed recent change entries that are suppressed from their creation

$wgNonincludableNamespaces can be bypassed by embedding redirect in other namespaces

API identification of users on private wikis

Pretty-printed API output combined with centralauthtoken allows XSS with certain gadgets

Stored i18n XSS in Special:ApiSandbox when a deprecated module is selected

Watchlist group mode reveals authors of edits with hidden authorship

Special:UserRights allows viewing user rights from private wiki

Stored XSS through a system message in the codex version of Special:Block

Stored XSS through system messages in MW Core

Sanitizer::validateAttributes data-XSS

Suppressed blocked IP is visible in Special:BlockList, RC, and other places

Stored XSS through system messages in Special:RecentChangesLinked (MW Core)

Codex Special:Block vulnerable to message key XSS

XSS in Special:ApiSandbox

Complete content leak of private wikis due to PasswordReset Wikitext injection in error message

Importing leaks IP address of importer via EventStreams

Customized help link for page protection indicator is relative to subpage name, because the link target is missing the "/wiki/" prefix

HTML rest endpoint needs PoolCounter and proper parser cache check

Autoblocks from global account suppressions are publicly visible

With MultiBlocks enabled and a user who is suppressed via a MultiBlock, a user without 'hideuser' can see the hidden username in the BlockList

"{{SITENAME}} registered email address has been changed" email sent to unverified email addresses

Magic word replacement in legacy parser allows using reserved data attributes through wikitext

i18n XSS through Special:Watchlist

HTML injection in API action=feedcontributions output from i18n message

MediaWiki should not consider autocreation as login for the purposes of security reauthentication