Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 156

Export CSV
CVE-2026-58032

mw.Api.getErrorMessage() may return injected HTML if used without errorformat=html

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Api/index.Js. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki
CVE-2026-58029

Full Account Takeover from BotPasswords and OAuth via action=changeauthenticationdata

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiChangeAuthenticationData.Php, includes/Api/ApiLinkAccount.Php, includes/Api/ApiRemoveAuthenticationData.Php, includes/Specials/SpecialLinkAccounts.Php, includes/Specials/SpecialUnlinkAccounts.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki
CVE-2026-34093

Special:UserRights allows viewing user rights from private wiki

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Specials/SpecialUserRights.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

CVSS 4.0 · 1.1 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki
CVE-2026-34094

Customized help link for page protection indicator is relative to subpage name, because the link target is missing the "/wiki/" prefix

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Page/Article.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki
CVE-2026-34087

Users API leaks whether privileged users have their user groups disabled for lack of 2FA

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation OATHAuth. This issue affects OATHAuth: from * before 1.43.7, 1.44.4, 1.45.2.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Oathauth
CVE-2026-34088

RecentChanges entries expose suppressed content via generated log page html

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

CVSS 4.0 · 1.3 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki
CVE-2026-34090

Suggested investigations: Handle suppressed usernames

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation CheckUser. This issue affects CheckUser: from 1.45.0 before 1.45.2.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Checkuser Checkuser
CVE-2026-34091

User localization leaked by AbuseFilter + EventStream

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

CVSS 4.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki
CVE-2026-34092

Block UI elements in 'tools'-sidebar shows presence of an autoblocked IP

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Skin/Skin.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki
CVE-2026-34095

action=raw with Special:Mypage subpage title responds with "Content-Type: text/html" on ctype=text/javascript request

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Actions/ActionEntryPoint.Php, includes/Request/FauxResponse.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki
CVE-2026-5266

Echo API Exposure of Sensitive Information to Unauthorized Actors

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Echo. This vulnerability is associated with program files includes/Api/ApiEchoNotifications.Php. This issue affects Echo: from * before 1.43.7, 1.44.4, 1.45.2.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Echo
CVE-2026-34086

AbuseFilter misuses ::userCanBitfield, exposing access-controlled information

Vulnerability in Wikimedia Foundation AbuseFilter. This issue affects AbuseFilter: from * before 1.43.7, 1.44.4, 1.45.2.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Abusefilter
CVE-2026-0669

Path Traversal vulnerability in CSS extension on certain web servers

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Wikimedia Foundation MediaWiki - CSS extension allows Path Traversal.This issue affects MediaWiki - CSS extension: 1.44, 1.43, 1.39.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Css Project Mediawiki Wikimedia
Products
Css Mediawiki Mediawiki-css Extension
CVE-2026-22714

i18n XSS, DoS and config SQLI in Monaco

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Monaco Skin allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Monaco Skin: 1.45, 1.44, 1.43, 1.39.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki-monaco Skin
CVE-2026-0668

VisualData extension: Regular Expression Denial of Service (ReDoS) via crafted user input

Inefficient Regular Expression Complexity vulnerability in Wikimedia Foundation MediaWiki - VisualData Extension allows Regular Expression Exponential Blowup.This issue affects MediaWiki - VisualData Extension: 1.45.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia Wikisphere
Products
Mediawiki Mediawiki-visualdata Extension Visualdata
CVE-2026-0670

Stored XSS through a system message and a user-provided parameter in ProofreadPage

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki - ProofreadPage Extension allows Cross-Site Scripting (XSS).This issue affects MediaWiki - ProofreadPage Extension: 1.45, 1.44, 1.43, 1.39.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia Wikisource
Products
Mediawiki Mediawiki-proofreadpage Extension Proofread Page
CVE-2026-0671

Multiple stored i18n/message-key XSSes in UploadWizard

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki - UploadWizard extension allows Cross-Site Scripting (XSS).This issue affects MediaWiki - UploadWizard extension: 1.45, 1.44, 1.43, 1.39.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki-extensions-uploadwizard Mediawiki-uploadwizard Extension
CVE-2026-22710

Stored XSS through autocomment system messages in Wikibase

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Wikibase Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Wikibase Extension: 1.45, 1.44, 1.43, 1.39.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki-wikibase Extension Wikibase
CVE-2026-22713

Stored XSS through edit summaries in GrowthExperiments

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - GrowthExperiments Extension: 1.45, 1.44, 1.43, 1.39.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Growth Mediawiki Wikimedia
Products
Growthexperiments Mediawiki Mediawiki-growthexperiments Extension