ME
Product
MediaWiki
51
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 4Medium 30Low 8
Watch
Add MediaWiki to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-58029 | 6.5 | Jul 1 | Full Account Takeover from BotPasswords and OAuth via action=changeauthenticationdata Affected: before 1.46.0, 1.45.4, 1.44.6, 1.43.9 |
| CVE-2026-58033 | 6.5 | Jul 1 | "Total number of distinct authors" statistic at action=info does not exclude revisions where the author name was deleted Affected: before 1.46.0, 1.45.4, 1.44.6, 1.43.9 |
| CVE-2025-67480 | 6.5 | Feb 3 | list=allrevisions can be used to bypass Extension:Lockdown Affected: before 1.39.16, 1.43.6, 1.44.3, 1.45.1 |
| CVE-2026-58032 | 6.1 | Jul 1 | mw.Api.getErrorMessage() may return injected HTML if used without errorformat=html Affected: before 1.46.0, 1.45.4, 1.44.6, 1.43.9 |
| CVE-2026-58037 | 6.1 | Jul 1 | Core log entries for exceptions and XSS issues in log entry formatting code that may be caused by user-controlled input Affected: before 1.46.0, 1.45.4, 1.44.6, 1.43.9 |
| CVE-2026-34095 | 6.1 | May 11 | action=raw with Special:Mypage subpage title responds with "Content-Type: text/html" on ctype=text/javascript request Affected: before 1.43.7, 1.44.4, 1.45.2 |
| CVE-2025-67481 | 6.1 | Feb 3 | mw.message(…).parse() doesn't output safe HTML, but it's being used as if it does Affected: before 1.39.16, 1.43.6, 1.44.3, 1.45.1 |
| CVE-2025-67483 | 6.1 | Feb 3 | Theoretical i18n XSS in mediawiki.page.preview.js when a page has multiple protection levels Affected: before 1.43.6, 1.44.3, 1.45.1 |
| CVE-2025-67475 | 6.1 | Feb 3 | Stored XSS through edit summaries in MW Core Affected: before 1.39.16, 1.43.6, 1.44.3, 1.45.1 |
| CVE-2025-67477 | 6.1 | Feb 3 | Stored XSS through a system message in Special:ApiSandbox Affected: before 1.44.3, 1.45.1 |
| CVE-2025-11261 | 6.1 | Feb 3 | Stored i18n XSS exposed by security patch for T402077 Affected: before 1.39.15, 1.43.5, 1.44.2 |
| CVE-2025-61645 | 6.1 | Feb 3 | CodexTablePager has i18n XSS Affected: before 1.44.1 |
| CVE-2025-61641 | 6.1 | Feb 2 | API list=allpages with maxsize is making really slow queries Affected: before 1.39.14, 1.43.4, 1.44.1 |
| CVE-2025-61642 | 6.1 | Feb 2 | Stored XSS through system messages provided to CodexHtmlForms Affected: before 1.39.14, 1.43.4, 1.44.1 |
| CVE-2025-61643 | 6.1 | Feb 2 | EventStreams publishes suppressed recent change entries that are suppressed from their creation Affected: before 1.39.14, 1.43.4, 1.44.1 |
| CVE-2026-58026 | 5.7 | Jul 1 | $wgNonincludableNamespaces can be bypassed by embedding redirect in other namespaces Affected: before 1.46.0, 1.45.4, 1.44.6, 1.43.9 |
| CVE-2026-58024 | 5.7 | Jul 1 | API identification of users on private wikis Affected: before 1.46.0, 1.45.4, 1.44.6, 1.43.9 |
| CVE-2026-58028 | 5.4 | Jul 1 | Pretty-printed API output combined with centralauthtoken allows XSS with certain gadgets Affected: before 1.46.0, 1.45.4, 1.44.6, 1.43.9 |
| CVE-2026-58031 | 5.4 | Jul 1 | Stored i18n XSS in Special:ApiSandbox when a deprecated module is selected Affected: 1.46.0-rc.0 before 1.46.0 |
| CVE-2025-61646 | 5.4 | Feb 3 | Watchlist group mode reveals authors of edits with hidden authorship Affected: before 1.39.14, 1.43.4, 1.44.1 |
| CVE-2026-34093 | 5.3 | May 11 | Special:UserRights allows viewing user rights from private wiki Affected: before 1.43.7, 1.44.4, 1.45.2 |
| CVE-2026-58035 | 4.8 | Jul 1 | Stored XSS through a system message in the codex version of Special:Block Affected: 1.46.0-rc.0 before 1.46.0 |
| CVE-2025-61637 | 4.8 | Feb 2 | Stored XSS through system messages in MW Core Affected: before 1.39.14, 1.43.4, 1.44.1 |
| CVE-2025-61638 | 4.8 | Feb 2 | Sanitizer::validateAttributes data-XSS Affected: before 1.39.14, 1.43.4, 1.44.1 |
| CVE-2025-61639 | 4.8 | Feb 2 | Suppressed blocked IP is visible in Special:BlockList, RC, and other places Affected: before 1.39.14, 1.43.4, 1.44.1 |
| CVE-2025-61640 | 4.8 | Feb 2 | Stored XSS through system messages in Special:RecentChangesLinked (MW Core) Affected: before 1.39.14, 1.43.4, 1.44.1 |
| CVE-2025-61636 | 4.8 | Feb 2 | Codex Special:Block vulnerable to message key XSS Affected: before 1.39.14, 1.43.4, 1.44.1 |
| CVE-2025-6594 | 4.7 | Feb 2 | XSS in Special:ApiSandbox Affected: 1.27.0 before 1.39.13, 1.42.7 1.43.2, 1.44.0 |
| CVE-2025-6590 | 4.6 | Feb 2 | Complete content leak of private wikis due to PasswordReset Wikitext injection in error message Affected: through 1.39.12, 1.42.76 1.43.1, 1.44.0 |
| CVE-2025-67476 | 4.3 | Feb 3 | Importing leaks IP address of importer via EventStreams Affected: before 1.44.3, 1.45.1 |
Showing 30