Wikimedia Foundation vulnerabilities | LiveThreat CVE Feed

CVE	Product	CVSS	EPSS	Published	Summary
CVE-2026-102796	MU Mediawiki - UserPageViewTracker Extension Wikimedia Foundation	7.5	0%	Sep 29	Unauthenticated SQL injection in UserPageViewTracker via filterusers and ignoreusers parameters
CVE-2026-100245	MW Mediawiki - Wikibase Extension Wikimedia Foundation	6.1	0%	Sep 29	Stored XSS on Wikibase Special:SetSiteLink via unescaped system message
CVE-2026-100244	MC Mediawiki - CentralAuth Extension Wikimedia Foundation	7.5	0%	Sep 29	CentralAuth exposes locally suppressed block information via globaluserinfo API and Special:CentralAuth (incomplete fix for CVE-2025-62669)
CVE-2026-100243	MW Mediawiki - WikiSEO Extension Wikimedia Foundation	6.1	0%	Sep 29	Stored XSS in WikiSEO author and image properties on action=info
CVE-2026-100242	MD Mediawiki - DataTransfer Extension Wikimedia Foundation	7.5	0%	Sep 29	DataTransfer depends on phpspreadsheet version vulnerable to CVE-2026-59933 (XLS/OLE memory exhaustion)
CVE-2026-100241	ME Mediawiki - EventBus Extension Wikimedia Foundation	7.5	0%	Sep 29	Private change tags exposed to anonymous users via revision-tags-change events
CVE-2026-100240	MT Mediawiki - TemplateSandbox Extension Wikimedia Foundation	9.1	0%	Sep 29	TemplateSandbox does not check read permissions for the page being previewed
CVE-2026-100238	MF Mediawiki - Flow Extension Wikimedia Foundation	6.1	0%	Sep 29	Flow colon-separator and flow-guidedtour-optin-welcome-description messages allow stored XSS
CVE-2026-100383	MW Mediawiki - WikiLambda Extension Wikimedia Foundation	4.8	0%	Sep 25	Stored i18n XSS in WikiLambda's VisualEditor integration
CVE-2026-100382	ME Mediawiki - ExternalData Extension Wikimedia Foundation	10.0	1%	Sep 25	Unauthenticated remote code execution through wikitext in ExternalData
CVE-2026-100381	MU Mediawiki - UploadWizard Extension Wikimedia Foundation	5.3	0%	Sep 25	UploadWizard Flickr collection and set titles allow DOM XSS
CVE-2026-100380	MW Mediawiki - Wikibase Extension Wikimedia Foundation	5.3	0%	Sep 25	Reflected XSS in Wikibase Special:SetLabel language validation
CVE-2026-100379	WA Wikipedia Android App Wikimedia Foundation	5.3	0%	Sep 25	Cross-request disclosure of CentralAuth cookies in Wikipedia Android App
CVE-2026-100378	MT Mediawiki - Translate Extension Wikimedia Foundation	5.3	0%	Sep 25	Missing permission check in the Translate sandbox doRemind action
CVE-2026-100376	MT Mediawiki - TemplateSandbox Extension Wikimedia Foundation	4.8	0%	Sep 25	TemplateSandbox can be abused for XSS by asking another user to preview a page with a certain sandbox prefix
CVE-2026-100377	MW Mediawiki - WikiLambda Extension Wikimedia Foundation	6.9	0%	Sep 25	Revision-deleted pages can be viewed through WikiLambda's action=edit and Special:ViewAbstract
CVE-2026-58025	ME MediaWiki Wikimedia Foundation	9.8	1%	Jul 1	Remote Code Execution via Unsafe Deserialization in LogItem Import
CVE-2026-58029	ME MediaWiki Wikimedia Foundation	6.5	0%	Jul 1	Full Account Takeover from BotPasswords and OAuth via action=changeauthenticationdata
CVE-2026-58028	ME MediaWiki Wikimedia Foundation	5.4	0%	Jul 1	Pretty-printed API output combined with centralauthtoken allows XSS with certain gadgets
CVE-2026-58026	ME MediaWiki Wikimedia Foundation	5.7	0%	Jul 1	$wgNonincludableNamespaces can be bypassed by embedding redirect in other namespaces
CVE-2026-8857	TI timeline Wikimedia Foundation	8.8	2%	Jul 1	Full RCE using EasyTimeline Extension
CVE-2026-58038	TI timeline Wikimedia Foundation	6.1	0%	Jul 1	Stored XSS through javascript URLs in SVGs generated by EasyTimeline
CVE-2026-58027	AB AbuseFilter Wikimedia Foundation	6.5	0%	Jul 1	QueryAbuseFilter API can be used to see the hit count of private filters, which is hidden in the UI
CVE-2026-58030	SY SyntaxHighlight_GeSHi Wikimedia Foundation	6.1	0%	Jul 1	SyntaxHighlight stored XSS via unsanitized 'linelinks' attribute
CVE-2026-58032	ME MediaWiki Wikimedia Foundation	6.1	0%	Jul 1	mw.Api.getErrorMessage() may return injected HTML if used without errorformat=html
CVE-2026-58033	ME MediaWiki Wikimedia Foundation	6.5	0%	Jul 1	"Total number of distinct authors" statistic at action=info does not exclude revisions where the author name was deleted
CVE-2026-58037	ME MediaWiki Wikimedia Foundation	6.1	0%	Jul 1	Core log entries for exceptions and XSS issues in log entry formatting code that may be caused by user-controlled input
CVE-2026-58036	ME MediaWiki Wikimedia Foundation	7.5	0%	Jul 1	Users API leaks whether privileged users have their user groups disabled for lack of 2FA
CVE-2026-58024	ME MediaWiki Wikimedia Foundation	5.7	0%	Jul 1	API identification of users on private wikis
CVE-2026-13707	OA OAuth Wikimedia Foundation	7.6	0%	Jul 1	Session fixation attacks on improperly configured OAuth 1.0a tools
CVE-2026-13706	UR UrlShortener Wikimedia Foundation	8.8	0%	Jul 1	UrlShortener extension url validation can be bypassed due to difference between php url parsing and WHATWG
CVE-2026-58031	ME MediaWiki Wikimedia Foundation	5.4	0%	Jul 1	Stored i18n XSS in Special:ApiSandbox when a deprecated module is selected
CVE-2026-58034	CH CheckUser Wikimedia Foundation	4.8	0%	Jul 1	Stored XSS through a system message when blocking a temporary account that's related to other temporary accounts
CVE-2026-58035	ME MediaWiki Wikimedia Foundation	4.8	0%	Jul 1	Stored XSS through a system message in the codex version of Special:Block
CVE-2026-5266	EC Echo Wikimedia Foundation	2.3	0%	May 11	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Echo
CVE-2026-34095	ME MediaWiki Wikimedia Foundation	6.1	0%	May 11	action=raw with Special:Mypage subpage title responds with "Content-Type: text/html" on ctype=text/javascript request
CVE-2026-34094	ME MediaWiki Wikimedia Foundation	3.8	0%	May 11	Customized help link for page protection indicator is relative to subpage name, because the link target is missing the "/wiki/" prefix
CVE-2026-34093	ME MediaWiki Wikimedia Foundation	5.3	0%	May 11	Special:UserRights allows viewing user rights from private wiki
CVE-2026-34092	ME MediaWiki Wikimedia Foundation	7.5	0%	May 11	Block UI elements in 'tools'-sidebar shows presence of an autoblocked IP
CVE-2026-34091	ME MediaWiki Wikimedia Foundation	7.5	0%	May 11	User localization leaked by AbuseFilter + EventStream
CVE-2026-34090	CH CheckUser Wikimedia Foundation	7.5	0%	May 11	Suggested investigations: Handle suppressed usernames
CVE-2026-34089	SC Scribunto Wikimedia Foundation	7.5	0%	May 11	Memory leak in Scribunto causes runJobs.php to run out of memory
CVE-2026-34088	ME MediaWiki Wikimedia Foundation	7.5	0%	May 11	RecentChanges entries expose suppressed content via generated log page html
CVE-2026-34087	OA OATHAuth Wikimedia Foundation	7.5	0%	May 11	Users API leaks whether privileged users have their user groups disabled for lack of 2FA
CVE-2026-34086	AB AbuseFilter Wikimedia Foundation	2.1	0%	May 11	AbuseFilter misuses ::userCanBitfield, exposing access-controlled information
CVE-2026-39837	MC Mediawiki - Cargo Extension Wikimedia Foundation	5.4	0%	Apr 7	Stored XSS through the dynamic table format in Cargo
CVE-2026-39841	MC Mediawiki - Cargo Extension Wikimedia Foundation	6.1	0%	Apr 7	Stored XSS through list fields on Cargo's page values and Special:CargoTables
CVE-2026-39840	MC Mediawiki - Cargo Extension Wikimedia Foundation	6.1	0%	Apr 7	CSS injection in multiple Cargo display formats
CVE-2026-39839	MC Mediawiki - Cargo Extension Wikimedia Foundation	6.1	0%	Apr 7	Stored XSS through URLs in Cargo's map format
CVE-2026-39838	MP MediaWiki - ProofreadPage Extension Wikimedia Foundation	6.9	0%	Apr 7	ProofreadPage improperly sanitizes multiline styles using Sanitizer::checkCSS
CVE-2026-5762	MR MediaWiki - ReportIncident Extension Wikimedia Foundation	5.3	0%	Apr 7	ReportIncident DiscussionTools integration causes slow requests
CVE-2025-67481	ME MediaWiki Wikimedia Foundation	6.1	0%	Feb 3	mw.message(…).parse() doesn't output safe HTML, but it's being used as if it does
CVE-2025-67482	LU luasandbox Wikimedia Foundation	1.7	0%	Feb 3	Lua segfault in unpack()
CVE-2025-67483	ME MediaWiki Wikimedia Foundation	6.1	0%	Feb 3	Theoretical i18n XSS in mediawiki.page.preview.js when a page has multiple protection levels
CVE-2025-67484	ME MediaWiki Wikimedia Foundation	9.8	0%	Feb 3	Action API xslt option allows JavaScript execution by administrators who are not interface administrators
CVE-2025-67480	ME MediaWiki Wikimedia Foundation	6.5	0%	Feb 3	list=allrevisions can be used to bypass Extension:Lockdown
CVE-2025-67475	ME MediaWiki Wikimedia Foundation	6.1	0%	Feb 3	Stored XSS through edit summaries in MW Core
CVE-2025-67476	ME MediaWiki Wikimedia Foundation	4.3	0%	Feb 3	Importing leaks IP address of importer via EventStreams
CVE-2025-67477	ME MediaWiki Wikimedia Foundation	6.1	0%	Feb 3	Stored XSS through a system message in Special:ApiSandbox
CVE-2025-67478	CH CheckUser Wikimedia Foundation	8.8	0%	Feb 3	Wrong E-Mail address composition for usernames with a comma and Umlauts in it like "Döe, Jähn"