Vulnerabilities

TI-2026-12140 CVE-2026-14358 · GHSA-f5m8-q8gq-mjpw

Stored XSS in Wikimedia Chart pie tooltip via Data:*.tab field title

LOW 30

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Charts Extension allows Cross-Site Scripting (XSS).

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00298 Published 2026-07-01 Fixed in 1.43.9,1.44.6,1.45.4 CWE-79

TI-2026-42108 CVE-2026-58517 · GHSA-9r5v-wvvq-6v9f

Blocked users can create and edit WikiLambda objects

LOW 36

Improper neutralization of input terminators vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Authentication Bypass.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00329 Published 2026-07-01 Fixed in 1.43.9,1.44.6,1.45.4 CWE-288

TI-2026-42111 CVE-2026-58520 · GHSA-q84p-w2wj-782m

UrlShortener defaults to ineffective validation open to third-party redirects

LOW 36

URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - UrlShortener Extension allows Cross-Site Flashing.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00282 Published 2026-07-01 Fixed in 1.43.9, 1.44.6 +1 CWE-601

TI-2026-41780 CVE-2026-58025 · GHSA-28rr-rpqp-g8c8

Remote Code Execution via Unsafe Deserialization in LogItem Import

LOW 27

Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki.

CVSS 4.0MEDIUM 5.9 Network High privileges No interaction EPSS 0.00503 Published 2026-07-01 Fixed in 1.46.0, 1.45.4 +2 CWE-502

TI-2026-41784 CVE-2026-58029 · GHSA-gpg7-6j8p-9wg5

Full Account Takeover from BotPasswords and OAuth via action=changeauthenticationdata

LOW 24

Vulnerability in Wikimedia Foundation MediaWiki.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00351 Published 2026-07-01 Fixed in 1.46.0, 1.45.4 +2 CWE-287

TI-2026-41783 CVE-2026-58028 · GHSA-jqc3-4vrw-8965

Pretty-printed API output combined with centralauthtoken allows XSS with certain gadgets

LOW 2

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation CentralAuth.

CVSS 4.0N/A 0.0 Network Low privileges No interaction EPSS 0.00267 Published 2026-07-01 Fixed in 1.46.0, 1.45.4 +2 CWE-79

TI-2026-41781 CVE-2026-58026 · GHSA-jp4p-rf6v-wv5p

$wgNonincludableNamespaces can be bypassed by embedding redirect in other namespaces

LOW 3

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.

CVSS 4.0N/A 0.0 Network Low privileges User interaction EPSS 0.00369 Published 2026-07-01 Fixed in 1.46.0, 1.45.4 +2 CWE-200

TI-2026-07780 CVE-2026-8857 · GHSA-q6xp-j96f-7vmp

Full RCE using EasyTimeline Extension

LOW 7

A vulnerability in Wikimedia Foundation timeline.

CVSS 4.0N/A 0.0 Network Low privileges No interaction EPSS 0.02098 Published 2026-07-01 Fixed in 1.46.0, 1.45.4 +2 CWE-94

TI-2026-41793 CVE-2026-58038 · GHSA-pm32-8hr8-567h

Stored XSS through javascript URLs in SVGs generated by EasyTimeline

LOW 3

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation timeline.

CVSS 4.0N/A 0.0 Network Low privileges No interaction EPSS 0.00273 Published 2026-07-01 Fixed in 1.46.0, 1.45.4 +2 CWE-79

TI-2026-41782 CVE-2026-58027 · GHSA-xf4f-w4h8-w7rr

QueryAbuseFilter API can be used to see the hit count of private filters, which is hidden in the UI

LOW 24

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00371 Published 2026-07-01 Fixed in 1.46.0, 1.45.4 +2 CWE-200

TI-2026-41785 CVE-2026-58030 · GHSA-vmx6-3fp5-595p

SyntaxHighlight stored XSS via unsanitized 'linelinks' attribute

LOW 24

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation SyntaxHighlight_GeSHi.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0027 Published 2026-07-01 Fixed in 1.46.0, 1.45.4 +2 CWE-79

TI-2026-41787 CVE-2026-58032 · GHSA-2pj3-wqpx-g8cm

mw.Api.getErrorMessage() may return injected HTML if used without errorformat=html

LOW 24

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00299 Published 2026-07-01 Fixed in 1.46.0, 1.45.4 +2 CWE-79

TI-2026-41788 CVE-2026-58033 · GHSA-r39h-799c-h846

"Total number of distinct authors" statistic at action=info does not exclude revisions where the author name was deleted

LOW 24

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00413 Published 2026-07-01 Fixed in 1.46.0, 1.45.4 +2 CWE-200

TI-2026-41792 CVE-2026-58037 · GHSA-c9c4-xmc2-5h6x

Core log entries for exceptions and XSS issues in log entry formatting code that may be caused by user-controlled input

LOW 2

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.

CVSS 4.0N/A 0.0 Network Low privileges User interaction EPSS 0.0027 Published 2026-07-01 Fixed in 1.46.0, 1.45.4 +2 CWE-79

TI-2026-41791 CVE-2026-58036 · GHSA-qf2r-x8qv-xrwx

Users API leaks whether privileged users have their user groups disabled for lack of 2FA

LOW 11

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.

CVSS 4.0LOW 2.1 Network Low privileges User interaction EPSS 0.0032 Published 2026-07-01 Fixed in 1.46.0 CWE-200

TI-2026-41779 CVE-2026-58024 · GHSA-5mf7-4fq5-g3gp

API identification of users on private wikis

LOW 23

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00369 Published 2026-07-01 Fixed in 1.46.0, 1.45.4 +2 CWE-200

TI-2026-11556 CVE-2026-13707 · GHSA-qjj7-573r-4398

Session fixation attacks on improperly configured OAuth 1.0a tools

LOW 3

Session fixation vulnerability in Wikimedia Foundation OAuth.

CVSS 4.0N/A 0.0 Network Low privileges User interaction EPSS 0.00344 Published 2026-07-01 No fix listed CWE-384

TI-2026-11555 CVE-2026-13706 · GHSA-v4ch-5p7w-6w58

UrlShortener extension url validation can be bypassed due to difference between php url parsing and WHATWG

LOW 3

Improper input validation vulnerability in Wikimedia Foundation UrlShortener.

CVSS 4.0N/A 0.0 Network Low privileges No interaction EPSS 0.00479 Published 2026-07-01 No fix listed CWE-20

TI-2026-41786 CVE-2026-58031 · GHSA-f942-cxv6-p9mx

Stored i18n XSS in Special:ApiSandbox when a deprecated module is selected

LOW 2

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.

CVSS 4.0N/A 0.0 Network Low privileges User interaction EPSS 0.00267 Published 2026-07-01 Fixed in 1.46.0 CWE-79

TI-2026-41789 CVE-2026-58034 · GHSA-5m8f-rxqc-4gpj

Stored XSS through a system message when blocking a temporary account that's related to other temporary accounts

LOW 3

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser.

CVSS 4.0N/A 0.0 Network High privileges User interaction EPSS 0.00287 Published 2026-07-01 Fixed in 1.46.0 CWE-79

TI-2026-41790 CVE-2026-58035 · GHSA-gvg3-mcqq-v953

Stored XSS through a system message in the codex version of Special:Block

LOW 3

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.

CVSS 4.0N/A 0.0 Network High privileges User interaction EPSS 0.00287 Published 2026-07-01 Fixed in 1.46.0 CWE-79

TI-2026-42109 CVE-2026-58518 · GHSA-vjf9-r75w-m9fv

Cross-site request forgery in Wikimedia Foundation Mediawiki - RedirectManager Extension

HIGH 70

Cross-Site request forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - RedirectManager Extension allows Cross Site Request Forgery.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00129 Published 2026-07-01 Fixed in 1.3.3 CWE-352

TI-2026-26417 CVE-2026-34095 · GHSA-596g-9fv7-mq62

action=raw with Special:Mypage subpage title responds with "Content-Type: text/html" on ctype=text/javascript request

LOW 2

Vulnerability in Wikimedia Foundation MediaWiki.

CVSS 4.0N/A 0.0 Network High privileges No interaction EPSS 0.00183 Published 2026-05-11 Fixed in 1.43.7, 1.44.4 +1 CWE-668

TI-2026-26416 CVE-2026-34094 · GHSA-g863-m67x-whh5

Exposure of resource to wrong sphere in Wikimedia Foundation MediaWiki

LOW 10

Vulnerability in Wikimedia Foundation MediaWiki.

CVSS 4.0LOW 2.0 Network High privileges User interaction EPSS 0.0017 Published 2026-05-11 Fixed in 1.43.7, 1.44.4 +1 CWE-668

TI-2026-26415 CVE-2026-34093 · GHSA-34wc-vx7r-829j

Special:UserRights allows viewing user rights from private wiki

LOW 7

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.

CVSS 4.0LOW 1.1 Network Low privileges User interaction EPSS 0.00227 Published 2026-05-11 Fixed in 1.43.7, 1.44.4 +1 CWE-200

Vulnerabilities

Filters