Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 156

Export CSV
CVE-2026-103442

MergeAccount PHP object injection via session-key substitution

External control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection. This issue affects MediaWiki CentralAuth extension: 1.46, 1.45, and 1.43.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki - Centralauth Extension
CVE-2026-103441

Unauthenticated arbitrary file deletion through Wikibase serialized entity parsing

Deserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in Non-Executable Files. This issue affects MediaWiki Wikibase extension: 1.46, 1.45, and 1.43.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki-wikibase Extension
CVE-2026-58517

Blocked users can create and edit WikiLambda objects

Improper neutralization of input terminators vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Authentication Bypass. This issue affects Mediawiki - WikiLambda Extension: from * before 1.43.9,1.44.6,1.45.4.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki-wikilambda Extension
CVE-2026-103439

Various rawParams() and escaped() updates to prevent XSS in Wikibase extension

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikbase extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki Wikbase extension: 1.46, 1.45, and 1.43.

CVSS 4.0 · 0.3 Low EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki-wikibase Extension
CVE-2026-103446

WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments

Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass. This issue affects MediaWiki WikiLambda extension: 1.46.

CVSS 4.0 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki-wikilambda Extension
CVE-2026-103445

Stored XSS through PageForms #autoedit redirect links

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Page_Forms extension allows Stored XSS. This issue affects MediaWiki Page_Forms extension: 1.46, 1.45, and 1.43.

CVSS 4.0 · 1.2 Low EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki-page Forms Extension
CVE-2026-103437

ReadingLists imported metadata permits JavaScript URL XSS

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows Reflected XSS. This issue affects MediaWiki ReadingLists extension: 1.46 and 1.45.

CVSS 4.0 · 1.1 Low EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki-readinglists Extension
CVE-2026-103438

Various rawParams() and escaped() updates to prevent XSS in Wikistories extension

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikistories extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki Wikistories extension: 1.46, 1.45, and 1.43.

CVSS 4.0 · 0.3 Low EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki-wikistories Extension
CVE-2026-103048

Open Redirect in Special:Book

URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - Collection extension allows Fake the Source of Data. This issue affects Mediawiki - Collection extension: before 1.46.1, 1.45.5, 1.43.10.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki-collection Extension
CVE-2026-103044

EasyTimeline should not serve image maps as application/xml

XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection. This issue affects Mediawiki - EasyTimeline extension: before 1.46.1, 1.45.5, 1.43.10.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki - Easytimeline Extension
CVE-2026-100240

TemplateSandbox does not check read permissions for the page being previewed

Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - TemplateSandbox Extension: from * before 1.46.1, 1.45.5, 1.43.10.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki - Templatesandbox Extension
CVE-2026-103585

attacker-controlled javascript license URL via XSS

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki MediaSearch extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki MediaSearch extension: 1.46, 1.45, and 1.43.

CVSS 4.0 · 1.2 Low EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki-mediasearch Extension
CVE-2026-103584

attacker-controlled javascript license URL via XSS

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki CommonsMetadata extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki CommonsMetadata extension: 1.46, 1.45, and 1.43.

CVSS 4.0 · 1.1 Low EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki-commonsmetadata Extension
CVE-2026-103440

pagetriagelist discloses suppressed reviewer usernames

Exposure of sensitive information through data queries vulnerability in The Wikimedia Foundation MediaWiki PageTriage extension allows Information Elicitation. This issue affects MediaWiki PageTriage extension: 1.46, 1.45, and 1.43.

CVSS 4.0 · 1.2 Low EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki-pagetriage Extension
CVE-2026-103049

XSS in Cargo's Special:CargoQuery page due to unsanitized table headers

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: before 1.46.1.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki-cargo Extension
CVE-2026-103047

XSS through i18n message in CentralAuth

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth extension allows Stored XSS. This issue affects Mediawiki - CentralAuth extension: before 1.46.1, 1.45.5, 1.43.10.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki - Centralauth Extension
CVE-2026-100244

CentralAuth exposes locally suppressed block information via globaluserinfo API and Special:CentralAuth (incomplete fix for CVE-2025-62669)

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows Excavation. This issue affects Mediawiki - CentralAuth Extension: from * before 1.46.1, 1.45.5, 1.43.10.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki - Centralauth Extension
CVE-2026-103050

Stored i18n XSS in MassMessage

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - MassMessage extension allows Stored XSS. This issue affects Mediawiki - MassMessage extension: before 1.46.1, 1.45.5, 1.43.10.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki - Massmessage Extension
CVE-2026-103051

Stored i18n XSSs in CentralNotice

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralNotice extension allows Stored XSS. This issue affects Mediawiki - CentralNotice extension: before 1.46.1, 1.45.5, 1.43.10.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki - Centralnotice Extension
CVE-2026-103443

API permits session-seeded javascript URL XSS

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Collection (Book) extension allows XSS Targeting Non-Script Elements. This issue affects MediaWiki Collection (Book) extension: 1.46, 1.45, and 1.43.

CVSS 4.0 · 1.1 Low EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki-collection (book) Extension