Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6

Export CSV
CVE-2026-58517

Blocked users can create and edit WikiLambda objects

Improper neutralization of input terminators vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Authentication Bypass. This issue affects Mediawiki - WikiLambda Extension: from * before 1.43.9,1.44.6,1.45.4.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki-wikilambda Extension
CVE-2026-103446

WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments

Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass. This issue affects MediaWiki WikiLambda extension: 1.46.

CVSS 4.0 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki-wikilambda Extension
CVE-2026-103046

WikifunctionsFragmentRenderer does unsafe string replacements on user-provided HTML

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation MediaWiki - WikiLambda extension allows Stored XSS. This issue affects MediaWiki - WikiLambda extension: before 1.46.1.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki-wikilambda Extension
CVE-2026-100383

Stored i18n XSS in WikiLambda's VisualEditor integration

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has been remediated on the `master` branch.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki-wikilambda Extension
CVE-2026-100377

Revision-deleted pages can be viewed through WikiLambda's action=edit and Special:ViewAbstract

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Excavation. This issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has been remediated on the `master` branch.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki-wikilambda Extension
CVE-2026-96872

WikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositions

Improper handling of insufficient permissions or privileges vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension on Linux, MacOS, and Windows allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - WikiLambda Extension: before 1.47.0.

CVSS 4.0 · 2.9 Low EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki-wikilambda Extension