Wikimedia Foundation vulnerabilities
152 CVEs and advisories name Wikimedia Foundation as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-13706UrlShortener extension url validation can be bypassed due to difference between php url parsing and WHATWG
- CVE-2026-58031Stored i18n XSS in Special:ApiSandbox when a deprecated module is selected
- CVE-2026-58034Stored XSS through a system message when blocking a temporary account that's related to other temporary accounts
- CVE-2026-58035Stored XSS through a system message in the codex version of Special:Block
- CVE-2026-5266Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Echo.
- CVE-2026-34095action=raw with Special:Mypage subpage title responds with "Content-Type: text/html" on ctype=text/javascript request
- CVE-2026-34094Customized help link for page protection indicator is relative to subpage name, because the link target is missing the "/wiki/" prefix
- CVE-2026-34093Special:UserRights allows viewing user rights from private wiki
- CVE-2026-34092Block UI elements in 'tools'-sidebar shows presence of an autoblocked IP
- CVE-2026-34091User localization leaked by AbuseFilter + EventStream
- CVE-2026-34090Suggested investigations: Handle suppressed usernames
- CVE-2026-34089Memory leak in Scribunto causes runJobs.php to run out of memory
- CVE-2026-34088RecentChanges entries expose suppressed content via generated log page html
- CVE-2026-34087Users API leaks whether privileged users have their user groups disabled for lack of 2FA
- CVE-2026-34086AbuseFilter misuses ::userCanBitfield, exposing access-controlled information
- CVE-2026-39837Stored XSS through the dynamic table format in Cargo
- CVE-2026-39841Stored XSS through list fields on Cargo's page values and Special:CargoTables
- CVE-2026-39840CSS injection in multiple Cargo display formats
- CVE-2026-39839Stored XSS through URLs in Cargo's map format
- CVE-2026-39838ProofreadPage improperly sanitizes multiline styles using Sanitizer::checkCSS
- CVE-2026-5762ReportIncident DiscussionTools integration causes slow requests
- CVE-2025-67481mw.message(…).parse() doesn't output safe HTML, but it's being used as if it does
- CVE-2025-67482Lua segfault in unpack()
- CVE-2025-67483Theoretical i18n XSS in mediawiki.page.preview.js when a page has multiple protection levels
- CVE-2025-67484Action API xslt option allows JavaScript execution by administrators who are not interface administrators
- CVE-2025-67480list=allrevisions can be used to bypass Extension:Lockdown
- CVE-2025-67475Stored XSS through edit summaries in MW Core
- CVE-2025-67476Importing leaks IP address of importer via EventStreams
- CVE-2025-67477Stored XSS through a system message in Special:ApiSandbox
- CVE-2025-67478Wrong E-Mail address composition for usernames with a comma and Umlauts in it like "Döe, Jähn"