The Wikimedia Foundation - vulnerabilities (CVEs)

98 CVEs in 75 products, 20 in the last 30 days, newest from 2026-09-30.

Products

Mediawiki - Cargo Extension - 10 CVEs
Mediawiki - Growthexperiments Extension - 4 CVEs
Mediawiki - Wikilambda Extension - 4 CVEs
Mediawiki - Cargo - 3 CVEs
Mediawiki - Centralauth Extension - 3 CVEs
Mediawiki - Cirrussearch Extension - 2 CVEs
Mediawiki - Css Extension - 2 CVEs
Mediawiki - Growth Experiments Extension - 2 CVEs
Mediawiki - Thanks Extension - 2 CVEs
Mediawiki - Wikilove Extension - 2 CVEs
Mediawiki - Advancedsearch Extension - 1 CVEs
Mediawiki - Ajax Poll Extension - 1 CVEs
Mediawiki - Apex Skin - 1 CVEs
Mediawiki - Approvedrevs Extension - 1 CVEs
Mediawiki - Campaignevents Extension - 1 CVEs
Mediawiki - Centralnotice Extension - 1 CVEs
Mediawiki - Charts Extension - 1 CVEs
Mediawiki - Collection Extension - 1 CVEs
Mediawiki - Confirm Account Extension - 1 CVEs
Mediawiki - Discussiontools Extension - 1 CVEs
Mediawiki - Easytimeline Extension - 1 CVEs
Mediawiki - Extensionsimplecalendar - 1 CVEs
Mediawiki - Externalguidance - 1 CVEs
Mediawiki - Flaggedrevs Extension - 1 CVEs
Mediawiki - Flexdiagrams Extension - 1 CVEs
Mediawiki - Globalwatchlist Extension - 1 CVEs
Mediawiki - Growthexperiments - 1 CVEs
Mediawiki - Html Tags - 1 CVEs
Mediawiki - Imagerating Extension - 1 CVEs
Mediawiki - Languageselector Extension - 1 CVEs
Mediawiki - Lastmodified Extension - 1 CVEs
Mediawiki - Lockdown Extension - 1 CVEs
Mediawiki - Massmessage Extension - 1 CVEs
Mediawiki - Mobile Frontend Extension - 1 CVEs
Mediawiki - Monaco Skin - 1 CVEs
Mediawiki - Multiboilerplate Extensionmaste - 1 CVEs
Mediawiki - Oauth Extension - 1 CVEs
Mediawiki - Pagetriage - 1 CVEs
Mediawiki - Pagetriage Extension - 1 CVEs
Mediawiki - Redirectmanager Extension - 1 CVEs
Mediawiki - Refreshed Skin - 1 CVEs
Mediawiki - Score Extension - 1 CVEs
Mediawiki - Securepoll Extension - 1 CVEs
Mediawiki - Tabs Extension - 1 CVEs
Mediawiki - Translate Extension - 1 CVEs
Mediawiki - Uploadwizard Extension - 1 CVEs
Mediawiki - Urlshortener Extension - 1 CVEs
Mediawiki - Version Compare Extension - 1 CVEs
Mediawiki - Visual Data Extension - 1 CVEs
Mediawiki - Wikibase Extension - 1 CVEs
Mediawiki - Wikibase Media Info Extension - 1 CVEs
Mediawiki - Wikidata Extension - 1 CVEs
Mediawiki - Wikistories - 1 CVEs
Mediawiki Cargo Extension - 1 CVEs
Mediawiki Centralauth Extension - 1 CVEs
Mediawiki Collection Book Extension - 1 CVEs
Mediawiki Commonsmetadata Extension - 1 CVEs
Mediawiki Cookieconsent Extension - 1 CVEs
Mediawiki Core - Feed Utils - 1 CVEs
Mediawiki Foundation - Springboard Extension - 1 CVEs
Mediawiki Globalblocking Extension - 1 CVEs
Mediawiki Mediasearch Extension - 1 CVEs
Mediawiki Page Forms Extension - 1 CVEs
Mediawiki Pageforms Extension - 1 CVEs
Mediawiki Pagetriage Extension - 1 CVEs
Mediawiki Pollny Extension - 1 CVEs
Mediawiki Quizgame Extension - 1 CVEs
Mediawiki Readinglists Extension - 1 CVEs
Mediawiki Watchanalytics Extension - 1 CVEs
Mediawiki Webauthn Extension - 1 CVEs
Mediawiki Wikbase Extension - 1 CVEs
Mediawiki Wikibase Extension - 1 CVEs
Mediawiki Wikiforum Extension - 1 CVEs
Mediawiki Wikilambda Extension - 1 CVEs
Mediawiki Wikistories Extension - 1 CVEs

Newest CVEs of The Wikimedia Foundation

CVE-2026-103585 - CVSS 1.2 (low), 2026-09-30: Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki MediaSearch extension allows…
CVE-2026-103584 - CVSS 1.1 (low), 2026-09-30: Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki CommonsMetadata extension…
CVE-2026-103440 - CVSS 1.2 (low), 2026-09-30: Exposure of sensitive information through data queries vulnerability in The Wikimedia Foundation MediaWiki PageTriage extension allows Information…
CVE-2026-103439 - CVSS 0.3 (low), 2026-09-30: Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikbase extension allows…
CVE-2026-103438 - CVSS 0.3 (low), 2026-09-30: Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikistories extension allows…
CVE-2026-103437 - CVSS 1.1 (low), 2026-09-30: Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension…
CVE-2026-103446 - CVSS 7.4 (high), 2026-09-30: Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass. This…
CVE-2026-103445 - CVSS 1.2 (low), 2026-09-30: Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Page_Forms extension allows…
CVE-2026-103444 - CVSS 1.1 (low), 2026-09-30: Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki WikiForum extension allows…
CVE-2026-103443 - CVSS 1.1 (low), 2026-09-30: Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Collection (Book) extension…
CVE-2026-103442 - CVSS 7.2 (high), 2026-09-30: External control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection. This…
CVE-2026-103441 - CVSS 7.2 (high), 2026-09-30: Deserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in Non-Executable…
CVE-2026-103051 - CVSS 6.1 (medium), 2026-09-29: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralNotice…
CVE-2026-103050 - CVSS 6.1 (medium), 2026-09-29: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - MassMessage…
CVE-2026-103049 - CVSS 6.1 (medium), 2026-09-29: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo extension…
CVE-2026-103048 - CVSS 6.1 (medium), 2026-09-29: URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - Collection extension allows Fake the Source of Data.…
CVE-2026-103047 - CVSS 6.1 (medium), 2026-09-29: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth…
CVE-2026-103045 - CVSS 6.1 (medium), 2026-09-29: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Refreshed skin…
CVE-2026-103044 - CVSS 9.8 (critical), 2026-09-29: XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection. This issue…
CVE-2026-103046 - CVSS 6.1 (medium), 2026-09-29: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation MediaWiki - WikiLambda extension…
CVE-2026-96879 - CVSS 6.9 (medium), 2026-09-25: Improper removal of sensitive information before storage or transfer vulnerability in Wikimedia Foundation's Mediawiki - FlaggedRevs extension through 1.46.0.
CVE-2026-96878 - CVSS 6.9 (medium), 2026-09-25: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This…
CVE-2026-96877 - CVSS 6.9 (medium), 2026-09-25: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This…
CVE-2026-96876 - CVSS 6.9 (medium), 2026-09-25: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This…
CVE-2026-96875 - CVSS 6.9 (medium), 2026-09-25: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Stored XSS. This…
CVE-2026-100237 - CVSS 6.1 (medium), 2026-09-25: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Thanks Extension…
CVE-2026-96874 - CVSS 2.3 (low), 2026-09-25: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in the Mediawiki - Cargo extension allows Stored XSS. This…
CVE-2026-96873 - CVSS 5.5 (medium), 2026-09-24: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - CirrusSearch extension allows Reflected XSS.…
CVE-2026-96872 - CVSS 2.9 (low), 2026-09-23: Improper handling of insufficient permissions or privileges vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension on Linux, MacOS, and…
CVE-2026-14363 - CVSS 9.8 (critical), 2026-07-01: Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension…