Wikimedia Foundation - vulnerabilities (CVEs)

152 CVEs in 68 products, 8 in the last 30 days, newest from 2026-09-29.

Products

Mediawiki - 55 CVEs
Checkuser - 9 CVEs
Mediawiki - Cargo Extension - 4 CVEs
Abusefilter - 3 CVEs
Mediawiki - Abusefilter Extension - 3 CVEs
Mediawiki - Checkuser Extension - 3 CVEs
Mediawiki - Securepoll Extension - 3 CVEs
Mediawiki - Campaignevents Extension - 2 CVEs
Mediawiki - Centralauth Extension - 2 CVEs
Mediawiki - Datatransfer Extension - 2 CVEs
Mediawiki - Ipinfo Extension - 2 CVEs
Mediawiki - Mintydocs Extension - 2 CVEs
Mediawiki - Proofreadpage Extension - 2 CVEs
Mediawiki - Templatesandbox Extension - 2 CVEs
Mediawiki - Uploadwizard Extension - 2 CVEs
Mediawiki - Wikibase Extension - 2 CVEs
Mediawiki - Wikilambda Extension - 2 CVEs
Oathauth - 2 CVEs
Parsoid - 2 CVEs
Scribunto - 2 CVEs
Timeline - 2 CVEs
Vector - 2 CVEs
Visualeditor - 2 CVEs
Centralauth - 1 CVEs
Cite - 1 CVEs
Confirmedit - 1 CVEs
Discussiontools - 1 CVEs
Echo - 1 CVEs
Luasandbox - 1 CVEs
Mediawiki - Approvedrevs Extension - 1 CVEs
Mediawiki - Articlefeedbackv5 Extension - 1 CVEs
Mediawiki - Breadcrumbs2 Extension - 1 CVEs
Mediawiki - Css Extension - 1 CVEs
Mediawiki - Eventbus Extension - 1 CVEs
Mediawiki - Externaldata Extension - 1 CVEs
Mediawiki - Featuredfeeds Extension - 1 CVEs
Mediawiki - Flaggedrevs Extension - 1 CVEs
Mediawiki - Flow Extension - 1 CVEs
Mediawiki - Globalblocking Extension - 1 CVEs
Mediawiki - Googledocs4mw Extension - 1 CVEs
Mediawiki - Masseditregex Extension - 1 CVEs
Mediawiki - Mediasearch Extension - 1 CVEs
Mediawiki - Msupload Extension - 1 CVEs
Mediawiki - Openbadges Extension - 1 CVEs
Mediawiki - Quiz Extension - 1 CVEs
Mediawiki - Refreshspecial Extension - 1 CVEs
Mediawiki - Relatedarticles Extension - 1 CVEs
Mediawiki - Reportincident Extension - 1 CVEs
Mediawiki - Scribunto Extension - 1 CVEs
Mediawiki - Skinbluesky - 1 CVEs
Mediawiki - Socialprofile Extension - 1 CVEs
Mediawiki - Titleicon Extension - 1 CVEs
Mediawiki - Translate Extension - 1 CVEs
Mediawiki - Twocolconflict Extension - 1 CVEs
Mediawiki - Urlshortener Extension - 1 CVEs
Mediawiki - Userpageviewtracker Extension - 1 CVEs
Mediawiki - Visualdata Extension - 1 CVEs
Mediawiki - Wikicategorytagcloud Extension - 1 CVEs
Mediawiki - Wikihiero Extension - 1 CVEs
Mediawiki - Wikiseo Extension - 1 CVEs
Multimediaviewer - 1 CVEs
Oauth - 1 CVEs
Syntaxhighlight Geshi - 1 CVEs
Textextracts - 1 CVEs
Thanks - 1 CVEs
Urlshortener - 1 CVEs
Wikipedia Android App - 1 CVEs
Wikipedia Preview - 1 CVEs

Newest CVEs of Wikimedia Foundation

CVE-2026-102796 - CVSS 7.5 (high), 2026-09-29: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wikimedia Foundation Mediawiki - UserPageViewTracker…
CVE-2026-100245 - CVSS 6.1 (medium), 2026-09-29: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Wikibase…
CVE-2026-100244 - CVSS 7.5 (high), 2026-09-29: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows Excavation. This…
CVE-2026-100243 - CVSS 6.1 (medium), 2026-09-29: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - WikiSEO…
CVE-2026-100242 - CVSS 7.5 (high), 2026-09-29: Dependency on Vulnerable Third-Party Component and Uncontrolled Resource Consumption vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension…
CVE-2026-100241 - CVSS 7.5 (high), 2026-09-29: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - EventBus Extension allows Excavation. This issue…
CVE-2026-100240 - CVSS 9.1 (critical), 2026-09-29: Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Accessing Functionality Not Properly Constrained by…
CVE-2026-100238 - CVSS 6.1 (medium), 2026-09-29: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Flow Extension…
CVE-2026-100383 - CVSS 4.8 (medium), 2026-09-25: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - WikiLambda…
CVE-2026-100382 - CVSS 10 (critical), 2026-09-25: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Wikimedia Foundation Mediawiki - ExternalData…
CVE-2026-100381 - CVSS 5.3 (medium), 2026-09-25: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - UploadWizard…
CVE-2026-100380 - CVSS 5.3 (medium), 2026-09-25: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Wikibase…
CVE-2026-100379 - CVSS 5.3 (medium), 2026-09-25: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Wikipedia Android App allows Accessing/Intercepting/Modifying…
CVE-2026-100378 - CVSS 5.3 (medium), 2026-09-25: Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - Translate Extension allows Accessing Functionality Not Properly Constrained by ACLs.…
CVE-2026-100376 - CVSS 4.8 (medium), 2026-09-25: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox…
CVE-2026-100377 - CVSS 6.9 (medium), 2026-09-25: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Excavation. This…
CVE-2026-58025 - CVSS 9.8 (critical), 2026-07-01: Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files…
CVE-2026-58029 - CVSS 6.5 (medium), 2026-07-01: Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiChangeAuthenticationData.Php,…
CVE-2026-58028 - CVSS 5.4 (medium), 2026-07-01: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia…
CVE-2026-58026 - CVSS 5.7 (medium), 2026-07-01: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program…
CVE-2026-8857 - CVSS 8.8 (high), 2026-07-01: A vulnerability in Wikimedia Foundation timeline. This vulnerability is associated with program files scripts/EasyTimeline.Pl, includes/Timeline.Php. This…
CVE-2026-58038 - CVSS 6.1 (medium), 2026-07-01: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation timeline. This vulnerability…
CVE-2026-58027 - CVSS 6.5 (medium), 2026-07-01: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program…
CVE-2026-58030 - CVSS 6.1 (medium), 2026-07-01: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation SyntaxHighlight_GeSHi. This…
CVE-2026-58032 - CVSS 6.1 (medium), 2026-07-01: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This…
CVE-2026-58033 - CVSS 6.5 (medium), 2026-07-01: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program…
CVE-2026-58037 - CVSS 6.1 (medium), 2026-07-01: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This…
CVE-2026-58036 - CVSS 7.5 (high), 2026-07-01: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program…
CVE-2026-58024 - CVSS 5.7 (medium), 2026-07-01: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program…
CVE-2026-13707 - CVSS 7.6 (high), 2026-07-01: Session fixation vulnerability in Wikimedia Foundation OAuth. This vulnerability is associated with program files src/Backend/MWOAuthServer.Php. This issue…