WI
Vendor
Wikimedia
14
CVEs
0
On KEV
0
New 30D
Products
WQ6.1
Wikidata Query Gui
Wikimedia
3 CVEs0 on KEV0 new
PA6.1
Parsoid
Wikimedia
2 CVEs0 on KEV0 new
WI8.2
Wikimedia-extensions-css
Wikimedia
2 CVEs0 on KEV0 new
AN6.1
Analytics-quarry-web
Wikimedia
1 CVEs0 on KEV0 new
AP4.8
Apex
Wikimedia
1 CVEs0 on KEV0 new
CA5.3
Campaignevents
Wikimedia
1 CVEs0 on KEV0 new
ME6.1
Mediawiki-extensions-i18ntags
Wikimedia
1 CVEs0 on KEV0 new
ME6.1
Mediawiki-extensions-uploadwizard
Wikimedia
1 CVEs0 on KEV0 new
SC7.5
Scribunto
Wikimedia
1 CVEs0 on KEV0 new
WI5.4
Wikibase
Wikimedia
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-34089 | SC Scribunto Wikimedia | 7.5 | May 11 | Memory leak in Scribunto causes runJobs.php to run out of memory |
| CVE-2025-61638 | PA Parsoid Wikimedia | 4.8 | Feb 2 | Sanitizer::validateAttributes data-XSS |
| CVE-2026-0817 | CA Campaignevents Wikimedia | 5.3 | Jan 9 | CampaignEvents API missing authorization exposes meeting and chat URLs |
| CVE-2026-22710 | WI Wikibase Wikimedia | 5.4 | Jan 8 | Stored XSS through autocomment system messages in Wikibase |
| CVE-2026-0671 | ME Mediawiki-extensions-uploadwizard Wikimedia | 6.1 | Jan 8 | Multiple stored i18n/message-key XSSes in UploadWizard |
| CVE-2024-47841 | WI Wikimedia-extensions-css Wikimedia | 7.5 | Oct 5 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Path Traversal.This issue… |
| CVE-2024-47845 | WI Wikimedia-extensions-css Wikimedia | 8.2 | Oct 5 | Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Code Injection.This issue affects Mediawiki - CSS Extension:… |
| CVE-2024-47840 | AP Apex Wikimedia | 4.8 | Oct 5 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Apex skin allows Stored XSS.This… |
| CVE-2018-25065 | ME Mediawiki-extensions-i18ntags Wikimedia | 6.1 | Jan 5 | A vulnerability was found in Wikimedia mediawiki-extensions-I18nTags and classified as problematic |
| CVE-2020-36324 | AN Analytics-quarry-web Wikimedia | 6.1 | Apr 21 | Wikimedia Quarry analytics-quarry-web before 2020-12-15 allows Reflected XSS because app.py does not explicitly set the application/json content type |
| CVE-2021-30458 | PA Parsoid Wikimedia | 6.1 | Apr 9 | An issue was discovered in Wikimedia Parsoid before 0.11.1 and 0.12.x before 0.12.2 |
| CVE-2019-19329 | WQ Wikidata Query Gui Wikimedia | 6.1 | Nov 27 | In Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07, when mathematical expressions in results are displayed directly, arbitrary JavaScript execution can occur,… |
| CVE-2019-19328 | WQ Wikidata Query Gui Wikimedia | 6.1 | Nov 27 | ui/editor/tooltip/Rdf.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection in tooltips for entities |
| CVE-2019-19327 | WQ Wikidata Query Gui Wikimedia | 6.1 | Nov 27 | ui/ResultView.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection when reporting the number of results and number of milliseconds |