ME
Product
MediaWiki
51
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 4Medium 30Low 8
Watch
Add MediaWiki to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-34094 | 3.8 | May 11 | Customized help link for page protection indicator is relative to subpage name, because the link target is missing the "/wiki/" prefix Affected: before 1.43.7, 1.44.4, 1.45.2 |
| CVE-2025-61634 | 3.1 | Feb 2 | HTML rest endpoint needs PoolCounter and proper parser cache check Affected: before 1.39.14, 1.43.4, 1.44.1 |
| CVE-2025-6927 | 2.3 | Feb 2 | Autoblocks from global account suppressions are publicly visible Affected: >= 1.42.0 before 1.39.13, 1.42.7 1.43.2, 1.44.0 |
| CVE-2025-32700 | 2.3 | Apr 10 | AbuseFilter log interfaces expose global private and hidden filters when central DB is not available Affected: >= 1.43.0 before 1.43.1 |
| CVE-2025-6589 | 2.1 | Feb 2 | With MultiBlocks enabled and a user who is suppressed via a MultiBlock, a user without 'hideuser' can see the hidden username in the BlockList Affected: >= 1.42.0 |
| CVE-2025-6593 | 2.1 | Feb 2 | "{{SITENAME}} registered email address has been changed" email sent to unverified email addresses Affected: 1.27.0 before 1.39.13, 1.42.7 1.43.2, 1.44.0 |
| CVE-2025-32699 | 2.1 | Apr 10 | Potential javascript injection attack enabled by Unicode normalization in Action API Affected: before 1.39.12, 1.42.6, 1.43.1 |
| CVE-2025-32698 | 2.1 | Apr 10 | LogPager.php: Restriction enforcer functions do not correctly enforce suppression restrictions Affected: before 1.39.12, 1.42.6, 1.43.1 |
Showing 8