THE Wikimedia Foundation vulnerabilities
98 CVEs and advisories name THE Wikimedia Foundation as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-103585attacker-controlled javascript license URL via XSS
- CVE-2026-103584attacker-controlled javascript license URL via XSS
- CVE-2026-103440pagetriagelist discloses suppressed reviewer usernames
- CVE-2026-103439Various rawParams() and escaped() updates to prevent XSS in Wikibase extension
- CVE-2026-103438Various rawParams() and escaped() updates to prevent XSS in Wikistories extension
- CVE-2026-103437ReadingLists imported metadata permits JavaScript URL XSS
- CVE-2026-103446WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments
- CVE-2026-103445Stored XSS through PageForms #autoedit redirect links
- CVE-2026-103444Stored XSS through system messages in WikiForum
- CVE-2026-103443API permits session-seeded javascript URL XSS
- CVE-2026-103442MergeAccount PHP object injection via session-key substitution
- CVE-2026-103441Unauthenticated arbitrary file deletion through Wikibase serialized entity parsing
- CVE-2026-103051Stored i18n XSSs in CentralNotice
- CVE-2026-103050Stored i18n XSS in MassMessage
- CVE-2026-103049XSS in Cargo's Special:CargoQuery page due to unsanitized table headers
- CVE-2026-103048Open Redirect in Special:Book
- CVE-2026-103047XSS through i18n message in CentralAuth
- CVE-2026-103045XSS in Refreshed skin
- CVE-2026-103044EasyTimeline should not serve image maps as application/xml
- CVE-2026-103046WikifunctionsFragmentRenderer does unsafe string replacements on user-provided HTML
- CVE-2026-96879"Checked by" label in page history should not be shown if the underlying review log entry is suppressed"
- CVE-2026-96878Cargo Exhibit field alias allows stored XSS
- CVE-2026-96877Reflected XSS through Cargo Drilldown full-text search
- CVE-2026-96876Anonymous reflected XSS in CargoExport invalid-alias errors
- CVE-2026-96875Reflected XSS in Cargo Drilldown hierarchy filters
- CVE-2026-100237Stored i18n XSS in the Flow integration of Thanks
- CVE-2026-96874Stored XSS in Cargo Drilldown tab names
- CVE-2026-96873Reflected XSS in CirrusSearch debug explain output
- CVE-2026-96872WikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositions
- CVE-2026-14363Cargo Extension: SQLi in Special:Drilldown