Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

256 records

Vendor: Wikimedia Foundation Clear all filters
TI-2026-65735 CVE-2026-103585 · GHSA-q32v-6xg8-872f

attacker-controlled javascript license URL via XSS

Priority LOW 7

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki MediaSearch extension allows Cross-Site Scripting (XSS).

CVSS 4.0LOW 1.2 Network Low privileges User interaction EPSS 0.00302 Published 2026-09-30 No fix listed CWE-80
TI-2026-65734 CVE-2026-103584 · GHSA-v276-8895-8m7m

attacker-controlled javascript license URL via XSS

Priority LOW 7

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki CommonsMetadata extension allows Cross-Site Scripting (XSS).

CVSS 4.0LOW 1.1 Network High privileges User interaction EPSS 0.00285 Published 2026-09-30 No fix listed CWE-80
TI-2026-65692 CVE-2026-103440 · GHSA-vp5g-xhpv-4wq4

pagetriagelist discloses suppressed reviewer usernames

Priority LOW 7

Exposure of sensitive information through data queries vulnerability in The Wikimedia Foundation MediaWiki PageTriage extension allows Information Elicitation.

CVSS 4.0LOW 1.2 Network Low privileges User interaction EPSS 0.00272 Published 2026-09-30 No fix listed CWE-202
TI-2026-65689 CVE-2026-103437 · GHSA-c4w7-7m72-q5m9

ReadingLists imported metadata permits JavaScript URL XSS

Priority LOW 7

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows Reflected XSS.

CVSS 4.0LOW 1.1 Network Low privileges User interaction EPSS 0.00313 Published 2026-09-30 No fix listed CWE-80
TI-2026-65697 CVE-2026-103445 · GHSA-rcgv-pmpf-7frr

Stored XSS through PageForms #autoedit redirect links

Priority LOW 7

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Page_Forms extension allows Stored XSS.

CVSS 4.0LOW 1.2 Network Low privileges User interaction EPSS 0.00302 Published 2026-09-30 No fix listed CWE-80
TI-2026-65696 CVE-2026-103444 · GHSA-wr3h-qfmx-xxrx

Stored XSS through system messages in WikiForum

Priority LOW 7

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki WikiForum extension allows Stored XSS.

CVSS 4.0LOW 1.1 Network High privileges User interaction EPSS 0.00337 Published 2026-09-30 No fix listed CWE-80
TI-2026-65695 CVE-2026-103443 · GHSA-2fmc-4qg7-7m8x

API permits session-seeded javascript URL XSS

Priority LOW 7

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Collection (Book) extension allows XSS Targeting Non-Script Elements.

CVSS 4.0LOW 1.1 Network Low privileges User interaction EPSS 0.00201 Published 2026-09-30 No fix listed CWE-80
TI-2026-65694 CVE-2026-103442 · GHSA-7c6r-9xcw-h46m

MergeAccount PHP object injection via session-key substitution

Priority LOW 31

External control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection.

CVSS 4.0HIGH 7.2 Network High privileges User interaction EPSS 0.0028 Published 2026-09-30 No fix listed CWE-15
TI-2026-65572 CVE-2026-103051 · GHSA-pvqw-26jw-x4g6

Stored i18n XSSs in CentralNotice

Priority LOW 26

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralNotice extension allows Stored XSS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00155 Published 2026-09-29 Fixed in 1.46.1, 1.45.5 +1 CWE-79
TI-2026-65571 CVE-2026-103050 · GHSA-9j6w-3g83-7xg8

Stored i18n XSS in MassMessage

Priority LOW 26

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - MassMessage extension allows Stored XSS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00155 Published 2026-09-29 Fixed in 1.46.1, 1.45.5 +1 CWE-79
TI-2026-65570 CVE-2026-103049 · GHSA-wp5j-232x-fmpv

XSS in Cargo's Special:CargoQuery page due to unsanitized table headers

Priority LOW 26

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo extension allows Reflected XSS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00155 Published 2026-09-29 Fixed in 1.46.1 CWE-79
TI-2026-65569 CVE-2026-103048 · GHSA-h46v-wcxp-q8jp

Open Redirect in Special:Book

Priority LOW 26

URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - Collection extension allows Fake the Source of Data.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00147 Published 2026-09-29 Fixed in 1.46.1, 1.45.5 +1 CWE-601
TI-2026-65568 CVE-2026-103047 · GHSA-wm9g-fv6p-hww9

XSS through i18n message in CentralAuth

Priority LOW 26

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth extension allows Stored XSS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00155 Published 2026-09-29 Fixed in 1.46.1, 1.45.5 +1 CWE-79
TI-2026-65566 CVE-2026-103045 · GHSA-7j9q-53xp-5mqq

XSS in Refreshed skin

Priority LOW 26

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Refreshed skin allows Stored XSS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00155 Published 2026-09-29 Fixed in 1.46.1, 1.45.5 +1 CWE-79
TI-2026-65565 CVE-2026-103044 · GHSA-3cxg-pq55-vhm5

EasyTimeline should not serve image maps as application/xml

Priority MEDIUM 49

XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00436 Published 2026-09-29 Fixed in 1.46.1, 1.45.5 +1 CWE-91
TI-2026-64591 CVE-2026-100245 · GHSA-2rcm-h6cw-xrfr

Stored XSS on Wikibase Special:SetSiteLink via unescaped system message

Priority LOW 26

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows Stored XSS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00155 Published 2026-09-29 Fixed in 1.46.1, 1.45.5 +1 CWE-79
TI-2026-64589 CVE-2026-100243 · GHSA-rvcr-fqrj-f6pf

Stored XSS in WikiSEO author and image properties on action=info

Priority LOW 26

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - WikiSEO Extension allows Stored XSS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00155 Published 2026-09-29 Fixed in 1.46.1, 1.45.5 +1 CWE-79
Load more