ME
Vendor
Mediawiki
458
CVEs
0
On KEV
0
New 30D
Products
ME9.8
Mediawiki
Mediawiki
417 CVEs0 on KEV0 new
CA9.8
Cargo
Mediawiki
10 CVEs0 on KEV0 new
CH8.8
CheckUser
MediaWiki
9 CVEs0 on KEV0 new
AB7.5
Abusefilter
Mediawiki
3 CVEs0 on KEV0 new
VE6.1
Visual Editor
Mediawiki
3 CVEs0 on KEV0 new
MO6.1
Mobilefrontend
Mediawiki
2 CVEs0 on KEV0 new
CR7.5
Createredirect
Mediawiki
1 CVEs0 on KEV0 new
MA5.4
MassMessage
MediaWiki
1 CVEs0 on KEV0 new
MA6.1
Matomo
Mediawiki
1 CVEs0 on KEV0 new
ME–
Mediawik
Mediawiki
1 CVEs0 on KEV0 new
MB–
Mediawiki Botquery Ext
Mediawiki
1 CVEs0 on KEV0 new
PR3.1
ProofreadPage
MediaWiki
1 CVEs0 on KEV0 new
RF6.1
Rss For Mediawiki
Mediawiki
1 CVEs0 on KEV0 new
RS–
Rssreader
Mediawiki
1 CVEs0 on KEV0 new
SC9.8
Score
Mediawiki
1 CVEs0 on KEV0 new
SC–
Scribunto
Mediawiki
1 CVEs0 on KEV0 new
SD6.1
Semantic Drilldown
Mediawiki
1 CVEs0 on KEV0 new
SH6.1
Shortdescription
Mediawiki
1 CVEs0 on KEV0 new
SK6.1
Skin:cosmos
Mediawiki
1 CVEs0 on KEV0 new
WC6.1
Wikisource Category Browser
Mediawiki
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2023-37253 | PR ProofreadPage MediaWiki | 3.1 | Sep 14 | An issue was discovered in the ProofreadPage extension for MediaWiki through 1.39.3 |
| CVE-2023-37252 | CH CheckUser MediaWiki | 3.1 | Sep 14 | An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3 |
| CVE-2024-23176 | MA MassMessage MediaWiki | 5.4 | Sep 14 | An issue was discovered in the MassMessage extension in MediaWiki before 1.40.2 |
| CVE-2026-14363 | CA Cargo Mediawiki | 9.8 | Jul 1 | Cargo Extension: SQLi in Special:Drilldown |
| CVE-2026-14358 | ME Mediawiki Mediawiki | 6.1 | Jul 1 | Stored XSS in Wikimedia Chart pie tooltip via Data:*.tab field title |
| CVE-2026-58517 | ME Mediawiki Mediawiki | 4.3 | Jul 1 | Blocked users can create and edit WikiLambda objects |
| CVE-2026-58521 | CA Cargo Mediawiki | 9.8 | Jul 1 | SQLi in Cargo extension via year range filter |
| CVE-2026-58520 | ME Mediawiki Mediawiki | 6.1 | Jul 1 | UrlShortener defaults to ineffective validation open to third-party redirects |
| CVE-2026-58025 | ME Mediawiki Mediawiki | 9.8 | Jul 1 | Remote Code Execution via Unsafe Deserialization in LogItem Import |
| CVE-2026-58029 | ME Mediawiki Mediawiki | 6.5 | Jul 1 | Full Account Takeover from BotPasswords and OAuth via action=changeauthenticationdata |
| CVE-2026-58028 | ME Mediawiki Mediawiki | 5.4 | Jul 1 | Pretty-printed API output combined with centralauthtoken allows XSS with certain gadgets |
| CVE-2026-58026 | ME Mediawiki Mediawiki | 5.7 | Jul 1 | $wgNonincludableNamespaces can be bypassed by embedding redirect in other namespaces |
| CVE-2026-8857 | ME Mediawiki Mediawiki | 8.8 | Jul 1 | Full RCE using EasyTimeline Extension |
| CVE-2026-58038 | ME Mediawiki Mediawiki | 6.1 | Jul 1 | Stored XSS through javascript URLs in SVGs generated by EasyTimeline |
| CVE-2026-58027 | ME Mediawiki Mediawiki | 6.5 | Jul 1 | QueryAbuseFilter API can be used to see the hit count of private filters, which is hidden in the UI |
| CVE-2026-58030 | ME Mediawiki Mediawiki | 6.1 | Jul 1 | SyntaxHighlight stored XSS via unsanitized 'linelinks' attribute |
| CVE-2026-58032 | ME Mediawiki Mediawiki | 6.1 | Jul 1 | mw.Api.getErrorMessage() may return injected HTML if used without errorformat=html |
| CVE-2026-58033 | ME Mediawiki Mediawiki | 6.5 | Jul 1 | "Total number of distinct authors" statistic at action=info does not exclude revisions where the author name was deleted |
| CVE-2026-58037 | ME Mediawiki Mediawiki | 6.1 | Jul 1 | Core log entries for exceptions and XSS issues in log entry formatting code that may be caused by user-controlled input |
| CVE-2026-58036 | ME Mediawiki Mediawiki | 7.5 | Jul 1 | Users API leaks whether privileged users have their user groups disabled for lack of 2FA |
| CVE-2026-58024 | ME Mediawiki Mediawiki | 5.7 | Jul 1 | API identification of users on private wikis |
| CVE-2026-13707 | ME Mediawiki Mediawiki | 7.6 | Jul 1 | Session fixation attacks on improperly configured OAuth 1.0a tools |
| CVE-2026-13706 | ME Mediawiki Mediawiki | 8.8 | Jul 1 | UrlShortener extension url validation can be bypassed due to difference between php url parsing and WHATWG |
| CVE-2026-58031 | ME Mediawiki Mediawiki | 5.4 | Jul 1 | Stored i18n XSS in Special:ApiSandbox when a deprecated module is selected |
| CVE-2026-58034 | ME Mediawiki Mediawiki | 4.8 | Jul 1 | Stored XSS through a system message when blocking a temporary account that's related to other temporary accounts |
| CVE-2026-58035 | ME Mediawiki Mediawiki | 4.8 | Jul 1 | Stored XSS through a system message in the codex version of Special:Block |
| CVE-2026-58519 | CA Cargo Mediawiki | 5.4 | Jul 1 | Stored XSS through Cargo's map format |
| CVE-2026-58518 | ME Mediawiki Mediawiki | 6.3 | Jul 1 | Cross-Site request forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - RedirectManager Extension allows Cross Site Request Forgery |
| CVE-2026-34095 | ME Mediawiki Mediawiki | 6.1 | May 11 | action=raw with Special:Mypage subpage title responds with "Content-Type: text/html" on ctype=text/javascript request |
| CVE-2026-34094 | ME Mediawiki Mediawiki | 3.8 | May 11 | Customized help link for page protection indicator is relative to subpage name, because the link target is missing the "/wiki/" prefix |
| CVE-2026-34093 | ME Mediawiki Mediawiki | 5.3 | May 11 | Special:UserRights allows viewing user rights from private wiki |
| CVE-2026-34092 | ME Mediawiki Mediawiki | 7.5 | May 11 | Block UI elements in 'tools'-sidebar shows presence of an autoblocked IP |
| CVE-2026-34091 | ME Mediawiki Mediawiki | 7.5 | May 11 | User localization leaked by AbuseFilter + EventStream |
| CVE-2026-34090 | CH Checkuser Mediawiki | 7.5 | May 11 | Suggested investigations: Handle suppressed usernames |
| CVE-2026-34088 | ME Mediawiki Mediawiki | 7.5 | May 11 | RecentChanges entries expose suppressed content via generated log page html |
| CVE-2026-34087 | ME Mediawiki Mediawiki | 7.5 | May 11 | Users API leaks whether privileged users have their user groups disabled for lack of 2FA |
| CVE-2026-39837 | CA Cargo Mediawiki | 5.4 | Apr 7 | Stored XSS through the dynamic table format in Cargo |
| CVE-2026-39841 | CA Cargo Mediawiki | 6.1 | Apr 7 | Stored XSS through list fields on Cargo's page values and Special:CargoTables |
| CVE-2026-39840 | CA Cargo Mediawiki | 6.1 | Apr 7 | CSS injection in multiple Cargo display formats |
| CVE-2026-39839 | CA Cargo Mediawiki | 6.1 | Apr 7 | Stored XSS through URLs in Cargo's map format |
| CVE-2025-67481 | ME Mediawiki Mediawiki | 6.1 | Feb 3 | mw.message(…).parse() doesn't output safe HTML, but it's being used as if it does |
| CVE-2025-67483 | ME Mediawiki Mediawiki | 6.1 | Feb 3 | Theoretical i18n XSS in mediawiki.page.preview.js when a page has multiple protection levels |
| CVE-2025-67484 | ME Mediawiki Mediawiki | 9.8 | Feb 3 | Action API xslt option allows JavaScript execution by administrators who are not interface administrators |
| CVE-2025-67480 | ME Mediawiki Mediawiki | 6.5 | Feb 3 | list=allrevisions can be used to bypass Extension:Lockdown |
| CVE-2025-67475 | ME Mediawiki Mediawiki | 6.1 | Feb 3 | Stored XSS through edit summaries in MW Core |
| CVE-2025-67476 | ME Mediawiki Mediawiki | 4.3 | Feb 3 | Importing leaks IP address of importer via EventStreams |
| CVE-2025-67477 | ME Mediawiki Mediawiki | 6.1 | Feb 3 | Stored XSS through a system message in Special:ApiSandbox |
| CVE-2025-67478 | CH Checkuser Mediawiki | 8.8 | Feb 3 | Wrong E-Mail address composition for usernames with a comma and Umlauts in it like "Döe, Jähn" |
| CVE-2025-61655 | VE Visual Editor Mediawiki | 6.1 | Feb 3 | Stored XSS through system messages in VisualEditor |
| CVE-2025-61656 | VE Visual Editor Mediawiki | 6.1 | Feb 3 | XSS when pasting into VE |
| CVE-2025-61658 | CH Checkuser Mediawiki | 4.3 | Feb 3 | Special:GlobalContributions shows edits on wikis the viewer doesn't have access to |
| CVE-2025-61651 | CH Checkuser Mediawiki | 6.1 | Feb 3 | i18n XSS through Special:CheckUser CheckUser helper |
| CVE-2025-11261 | ME Mediawiki Mediawiki | 6.1 | Feb 3 | Stored i18n XSS exposed by security patch for T402077 |
| CVE-2025-61648 | CH Checkuser Mediawiki | 6.1 | Feb 3 | Stored XSS through system messages in CheckUser |
| CVE-2025-61645 | ME Mediawiki Mediawiki | 6.1 | Feb 3 | CodexTablePager has i18n XSS |
| CVE-2025-61646 | ME Mediawiki Mediawiki | 5.4 | Feb 3 | Watchlist group mode reveals authors of edits with hidden authorship |
| CVE-2025-61637 | ME Mediawiki Mediawiki | 4.8 | Feb 2 | Stored XSS through system messages in MW Core |
| CVE-2025-61638 | ME Mediawiki Mediawiki | 4.8 | Feb 2 | Sanitizer::validateAttributes data-XSS |
| CVE-2025-61639 | ME Mediawiki Mediawiki | 4.8 | Feb 2 | Suppressed blocked IP is visible in Special:BlockList, RC, and other places |
| CVE-2025-61640 | ME Mediawiki Mediawiki | 4.8 | Feb 2 | Stored XSS through system messages in Special:RecentChangesLinked (MW Core) |