Vulnerabilities

TI-2026-41780 CVE-2026-58025 · GHSA-28rr-rpqp-g8c8

Remote Code Execution via Unsafe Deserialization in LogItem Import

LOW 27

Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki.

CVSS 4.0MEDIUM 5.9 Network High privileges No interaction EPSS 0.00503 Published 2026-07-01 Fixed in 1.46.0, 1.45.4 +2 CWE-502

TI-2026-41784 CVE-2026-58029 · GHSA-gpg7-6j8p-9wg5

Full Account Takeover from BotPasswords and OAuth via action=changeauthenticationdata

LOW 24

Vulnerability in Wikimedia Foundation MediaWiki.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00351 Published 2026-07-01 Fixed in 1.46.0, 1.45.4 +2 CWE-287

TI-2026-41783 CVE-2026-58028 · GHSA-jqc3-4vrw-8965

Pretty-printed API output combined with centralauthtoken allows XSS with certain gadgets

LOW 2

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation CentralAuth.

CVSS 4.0N/A 0.0 Network Low privileges No interaction EPSS 0.00267 Published 2026-07-01 Fixed in 1.46.0, 1.45.4 +2 CWE-79

TI-2026-41781 CVE-2026-58026 · GHSA-jp4p-rf6v-wv5p

$wgNonincludableNamespaces can be bypassed by embedding redirect in other namespaces

LOW 3

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.

CVSS 4.0N/A 0.0 Network Low privileges User interaction EPSS 0.00369 Published 2026-07-01 Fixed in 1.46.0, 1.45.4 +2 CWE-200

TI-2026-41787 CVE-2026-58032 · GHSA-2pj3-wqpx-g8cm

mw.Api.getErrorMessage() may return injected HTML if used without errorformat=html

LOW 24

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00299 Published 2026-07-01 Fixed in 1.46.0, 1.45.4 +2 CWE-79

TI-2026-41788 CVE-2026-58033 · GHSA-r39h-799c-h846

"Total number of distinct authors" statistic at action=info does not exclude revisions where the author name was deleted

LOW 24

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00413 Published 2026-07-01 Fixed in 1.46.0, 1.45.4 +2 CWE-200

TI-2026-41792 CVE-2026-58037 · GHSA-c9c4-xmc2-5h6x

Core log entries for exceptions and XSS issues in log entry formatting code that may be caused by user-controlled input

LOW 2

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.

CVSS 4.0N/A 0.0 Network Low privileges User interaction EPSS 0.0027 Published 2026-07-01 Fixed in 1.46.0, 1.45.4 +2 CWE-79

TI-2026-41779 CVE-2026-58024 · GHSA-5mf7-4fq5-g3gp

API identification of users on private wikis

LOW 23

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00369 Published 2026-07-01 Fixed in 1.46.0, 1.45.4 +2 CWE-200

Vulnerabilities

Filters