Where
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how mediawiki compares to other vendors in security performance

View Risk Score →

Mediawiki - Cargo ExtensionCargo Extension: SQLi in Special:Drilldown

Risk 86
Severity
6.9
First published (updated )
CVE-2026-14363

MediaWiki MediaWikiStored XSS in Wikimedia Chart pie tooltip via Data:*.tab field title

Risk 50
Severity
6.9
First published (updated )
CVE-2026-14358

MediaWiki MediaWikiBlocked users can create and edit WikiLambda objects

Risk 50
Severity
6.9
First published (updated )
CVE-2026-58517

Mediawiki - Cargo ExtensionSQLi in Cargo extension via year range filter

Risk 86
Severity
6.9
First published (updated )
CVE-2026-58521

MediaWiki MediaWikiUrlShortener defaults to ineffective validation open to third-party redirects

Risk 50
Severity
6.9
First published (updated )
CVE-2026-58520
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

MediaWiki MediaWikiRemote Code Execution via Unsafe Deserialization in LogItem Import

Risk 86
Severity
5.9
First published (updated )
CVE-2026-58025

MediaWiki MediaWikiFull Account Takeover from BotPasswords and OAuth via action=changeauthenticationdata

Risk 40
Severity
5.3
First published (updated )
CVE-2026-58029

Wikimedia Foundation MediaWikiPretty-printed API output combined with centralauthtoken allows XSS with certain gadgets

Risk 34
Severity
First published (updated )
CVE-2026-58028

MediaWiki MediaWiki$wgNonincludableNamespaces can be bypassed by embedding redirect in other namespaces

Risk 33
Severity
First published (updated )
CVE-2026-58026

MediaWiki MediaWikiFull RCE using EasyTimeline Extension

Risk 56
Severity
EPSS
0.39%
First published (updated )
CVE-2026-8857
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

MediaWiki MediaWikiStored XSS through javascript URLs in SVGs generated by EasyTimeline

Risk 38
Severity
First published (updated )
CVE-2026-58038

MediaWiki MediaWikiQueryAbuseFilter API can be used to see the hit count of private filters, which is hidden in the UI

Risk 38
Severity
5.3
First published (updated )
CVE-2026-58027

Wikimedia Foundation SyntaxHighlight_GeSHiSyntaxHighlight stored XSS via unsanitized 'linelinks' attribute

Risk 38
Severity
5.3
First published (updated )
CVE-2026-58030

MediaWiki MediaWikimw.Api.getErrorMessage() may return injected HTML if used without errorformat=html

Risk 38
Severity
5.3
First published (updated )
CVE-2026-58032

MediaWiki MediaWiki"Total number of distinct authors" statistic at action=info does not exclude revisions where the author name was deleted

Risk 37
Severity
5.3
First published (updated )
CVE-2026-58033
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

MediaWiki MediaWikiCore log entries for exceptions and XSS issues in log entry formatting code that may be caused by user-controlled input

Risk 38
Severity
First published (updated )
CVE-2026-58037

Wikimedia Foundation MediaWikiUsers API leaks whether privileged users have their user groups disabled for lack of 2FA

Risk 43
Severity
2.1
First published (updated )
CVE-2026-58036

MediaWiki MediaWikiAPI identification of users on private wikis

Risk 33
Severity
5.1
First published (updated )
CVE-2026-58024

MediaWiki MediaWikiSession fixation attacks on improperly configured OAuth 1.0a tools

Risk 62
Severity
First published (updated )
CVE-2026-13707

MediaWiki MediaWikiUrlShortener extension url validation can be bypassed due to difference between php url parsing and WHATWG

Risk 79
Severity
First published (updated )
CVE-2026-13706
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Wikimedia Foundation MediaWikiStored i18n XSS in Special:ApiSandbox when a deprecated module is selected

Risk 34
Severity
First published (updated )
CVE-2026-58031

Wikimedia Foundation CheckUserStored XSS through a system message when blocking a temporary account that's related to other temporary accounts

Risk 29
Severity
First published (updated )
CVE-2026-58034

Wikimedia Foundation MediaWikiStored XSS through a system message in the codex version of Special:Block

Risk 29
Severity
First published (updated )
CVE-2026-58035

The Wikimedia Foundation Mediawiki - Cargo ExtensionStored XSS through Cargo's map format

Risk 50
Severity
6.9
First published (updated )
CVE-2026-58519

Mediawiki - RedirectManager ExtensionCSRF

Risk 50
Severity
6.9
First published (updated )
CVE-2026-58518
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

MediaWiki MediaWikiaction=raw with Special:Mypage subpage title responds with "Content-Type: text/html" on ctype=text/javascript request

Risk 38
Severity
First published (updated )
CVE-2026-34095

MediaWiki MediaWikiCustomized help link for page protection indicator is relative to subpage name, because the link target is missing the "/wiki/" prefix

Risk 26
Severity
2
First published (updated )
CVE-2026-34094

MediaWiki MediaWikiSpecial:UserRights allows viewing user rights from private wiki

Risk 27
Severity
1.1
First published (updated )
CVE-2026-34093

MediaWiki MediaWikiBlock UI elements in 'tools'-sidebar shows presence of an autoblocked IP

Risk 43
Severity
2.1
First published (updated )
CVE-2026-34092

MediaWiki MediaWikiUser localization leaked by AbuseFilter + EventStream

Risk 43
Severity
5.5
First published (updated )
CVE-2026-34091
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203