Wikimedia Foundation vulnerabilities
152 CVEs and advisories name Wikimedia Foundation as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-102796Unauthenticated SQL injection in UserPageViewTracker via filterusers and ignoreusers parameters
- CVE-2026-100245Stored XSS on Wikibase Special:SetSiteLink via unescaped system message
- CVE-2026-100244CentralAuth exposes locally suppressed block information via globaluserinfo API and Special:CentralAuth (incomplete fix for CVE-2025-62669)
- CVE-2026-100243Stored XSS in WikiSEO author and image properties on action=info
- CVE-2026-100242DataTransfer depends on phpspreadsheet version vulnerable to CVE-2026-59933 (XLS/OLE memory exhaustion)
- CVE-2026-100241Private change tags exposed to anonymous users via revision-tags-change events
- CVE-2026-100240TemplateSandbox does not check read permissions for the page being previewed
- CVE-2026-100238Flow colon-separator and flow-guidedtour-optin-welcome-description messages allow stored XSS
- CVE-2026-100383Stored i18n XSS in WikiLambda's VisualEditor integration
- CVE-2026-100382Unauthenticated remote code execution through wikitext in ExternalData
- CVE-2026-100381UploadWizard Flickr collection and set titles allow DOM XSS
- CVE-2026-100380Reflected XSS in Wikibase Special:SetLabel language validation
- CVE-2026-100379Cross-request disclosure of CentralAuth cookies in Wikipedia Android App
- CVE-2026-100378Missing permission check in the Translate sandbox doRemind action
- CVE-2026-100376TemplateSandbox can be abused for XSS by asking another user to preview a page with a certain sandbox prefix
- CVE-2026-100377Revision-deleted pages can be viewed through WikiLambda's action=edit and Special:ViewAbstract
- CVE-2026-58025Remote Code Execution via Unsafe Deserialization in LogItem Import
- CVE-2026-58029Full Account Takeover from BotPasswords and OAuth via action=changeauthenticationdata
- CVE-2026-58028Pretty-printed API output combined with centralauthtoken allows XSS with certain gadgets
- CVE-2026-58026$wgNonincludableNamespaces can be bypassed by embedding redirect in other namespaces
- CVE-2026-8857Full RCE using EasyTimeline Extension
- CVE-2026-58038Stored XSS through javascript URLs in SVGs generated by EasyTimeline
- CVE-2026-58027QueryAbuseFilter API can be used to see the hit count of private filters, which is hidden in the UI
- CVE-2026-58030SyntaxHighlight stored XSS via unsanitized 'linelinks' attribute
- CVE-2026-58032mw.Api.getErrorMessage() may return injected HTML if used without errorformat=html
- CVE-2026-58033"Total number of distinct authors" statistic at action=info does not exclude revisions where the author name was deleted
- CVE-2026-58037Core log entries for exceptions and XSS issues in log entry formatting code that may be caused by user-controlled input
- CVE-2026-58036Users API leaks whether privileged users have their user groups disabled for lack of 2FA
- CVE-2026-58024API identification of users on private wikis
- CVE-2026-13707Session fixation attacks on improperly configured OAuth 1.0a tools