Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 127

Export CSV
CVE-2026-103444

Stored XSS through system messages in WikiForum

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki WikiForum extension allows Stored XSS. This issue affects MediaWiki WikiForum extension: master.

CVSS 4.0 · 1.1 Low EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki Wikiforum Extension
CVE-2026-103046

WikifunctionsFragmentRenderer does unsafe string replacements on user-provided HTML

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation MediaWiki - WikiLambda extension allows Stored XSS. This issue affects MediaWiki - WikiLambda extension: before 1.46.1.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki-wikilambda Extension
CVE-2026-96878

Cargo Exhibit field alias allows stored XSS

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki-cargo Extension
CVE-2026-96877

Reflected XSS through Cargo Drilldown full-text search

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki-cargo Extension
CVE-2026-96874

Stored XSS in Cargo Drilldown tab names

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in the Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki-cargo Extension
CVE-2026-96879

"Checked by" label in page history should not be shown if the underlying review log entry is suppressed"

Improper removal of sensitive information before storage or transfer vulnerability in Wikimedia Foundation's Mediawiki - FlaggedRevs extension through 1.46.0.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki - Flaggedrevs Extension
CVE-2026-96876

Anonymous reflected XSS in CargoExport invalid-alias errors

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki-cargo Extension
CVE-2026-96875

Reflected XSS in Cargo Drilldown hierarchy filters

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki-cargo Extension
CVE-2026-100237

Stored i18n XSS in the Flow integration of Thanks

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Thanks Extension allows Stored XSS. This issue affects Mediawiki - Thanks Extension: from * before 1.43.10/1.45.5/1.46.1.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki-thanks Extension
CVE-2026-96873

Reflected XSS in CirrusSearch debug explain output

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - CirrusSearch extension allows Reflected XSS. This issue affects Mediawiki - CirrusSearch extension through 1.46.0.

CVSS 4.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki-cirrussearch Extension
CVE-2026-100376

TemplateSandbox can be abused for XSS by asking another user to preview a page with a certain sandbox prefix

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - TemplateSandbox Extension: from * before 1.46.1, 1.45.5, 1.43.10.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki - Templatesandbox Extension
CVE-2026-100378

Missing permission check in the Translate sandbox doRemind action

Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - Translate Extension allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - Translate Extension: from * before 1.46.1, 1.45.5, 1.43.10.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki - Translate Extension
CVE-2026-100382

Unauthenticated remote code execution through wikitext in ExternalData

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Wikimedia Foundation Mediawiki - ExternalData Extension allows OS Command Injection. This issue affects Mediawiki - ExternalData Extension: from * before 3.7.

CVSS 4.0 · 10 Critical EPSS 1.2% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki - Externaldata Extension
CVE-2026-100380

Reflected XSS in Wikibase Special:SetLabel language validation

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - Wikibase Extension: from * before 1.46.1, 1.45.5, 1.43.10.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki-wikibase Extension
CVE-2026-100383

Stored i18n XSS in WikiLambda's VisualEditor integration

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has been remediated on the `master` branch.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki-wikilambda Extension
CVE-2026-100381

UploadWizard Flickr collection and set titles allow DOM XSS

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - UploadWizard Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - UploadWizard Extension: from * before 1.46.1, 1.45.5, 1.43.10.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki-uploadwizard Extension
CVE-2026-100377

Revision-deleted pages can be viewed through WikiLambda's action=edit and Special:ViewAbstract

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Excavation. This issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has been remediated on the `master` branch.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki-wikilambda Extension
CVE-2026-96872

WikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositions

Improper handling of insufficient permissions or privileges vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension on Linux, MacOS, and Windows allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - WikiLambda Extension: before 1.47.0.

CVSS 4.0 · 2.9 Low EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki-wikilambda Extension
CVE-2026-58520

UrlShortener defaults to ineffective validation open to third-party redirects

URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - UrlShortener Extension allows Cross-Site Flashing. This issue affects Mediawiki - UrlShortener Extension: from * before 1.43.9, 1.44.6, 1.45.4.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki-urlshortener Extension
CVE-2026-14358

Stored XSS in Wikimedia Chart pie tooltip via Data:*.tab field title

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Charts Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - Charts Extension: from * before 1.43.9,1.44.6,1.45.4.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki-charts Extension