Where
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how wikimedia foundation compares to other vendors in security performance

View Risk Score →

Software

wikimedia foundation mediawiki
53
wikimedia foundation checkuser
9
wikimedia foundation mediawiki - wikilambda extension
5
wikimedia foundation mediawiki centralauth extension
4
wikimedia foundation abusefilter
3
wikimedia foundation mediawiki - cargo extension
3
wikimedia foundation mediawiki cargo extension
3
wikimedia foundation wikipedia android app
3
wikimedia foundation mediawiki - campaignevents extension
2
wikimedia foundation mediawiki - centralauth extension
2
wikimedia foundation mediawiki - growth experiments extension
2
wikimedia foundation mediawiki - uploadwizard extension
2
wikimedia foundation mediawiki templatesandbox extension
2
wikimedia foundation mediawiki wikibase extension
2
wikimedia foundation oathauth
2
wikimedia foundation scribunto
2
wikimedia foundation vector
2
wikimedia foundation visualeditor
2
wikimedia foundation wikibase extension
2
wikimedia foundation campaignevents extension
1
wikimedia foundation centralauth
1
wikimedia foundation cite
1
wikimedia foundation confirmedit
1
wikimedia foundation discussiontools
1
wikimedia foundation echo
1
wikimedia foundation luasandbox
1
wikimedia foundation mediawiki - advancedsearch extension
1
wikimedia foundation mediawiki - ajax poll extension
1
wikimedia foundation mediawiki - charts extension
1
wikimedia foundation mediawiki - cirrussearch extension
1
wikimedia foundation mediawiki - confirm account extension
1
wikimedia foundation mediawiki - css extension
1
wikimedia foundation mediawiki - eventbus extension
1
wikimedia foundation mediawiki - externalguidance
1
wikimedia foundation mediawiki - flexdiagrams extension
1
wikimedia foundation mediawiki - flow extension
1
wikimedia foundation mediawiki - growthexperiments extension
1
wikimedia foundation mediawiki - imagerating extension
1
wikimedia foundation mediawiki - languageselector extension
1
wikimedia foundation mediawiki - lastmodified extension
1
wikimedia foundation mediawiki - multiboilerplate extension
1
wikimedia foundation mediawiki - oauth extension
1
wikimedia foundation mediawiki - pagetriage extension
1
wikimedia foundation mediawiki - proofreadpage extension
1
wikimedia foundation mediawiki - quiz extension
1
wikimedia foundation mediawiki - skin:bluesky
1
wikimedia foundation mediawiki - thanks extension
1
wikimedia foundation mediawiki - translate extension
1
wikimedia foundation mediawiki - urlshortener extension
1
wikimedia foundation mediawiki - visualdata extension
1

Wikimedia Foundation Wikipedia Android AppGHSL-2026-101: Malicious deep links can steal Wikipedia Android session cookies - CVE-2026-65993

Risk 58

Improper host validation in the Wikipedia Android app deep-link handler allows attackers to load malicious content, steal session cookies, and compromise user accounts.

First published (updated )
CVE-2026-65993

Wikimedia Foundation Wikipedia Android AppMalicious deep links can steal Wikipedia Android session cookies - CVE-2026-65993

Risk 57

Improper host validation in the Wikipedia Android app deep-link handler allows attackers to load malicious content, steal session cookies, and compromise user accounts.

First published (updated )
Advisory
GHSL-2026-101

Wikimedia Foundation Wikipedia for AndroidLocal apps can hijack Wikipedia Android WebViews and steal session cookies - CVE-2026-65994

Risk 34

A local application can invoke an exported Wikipedia Android activity to load an attacker-controlled webpage, steal session cookies, and expose personal information.

First published (updated )
Advisory
GHSL-2026-103

Wikimedia Foundation MediaWiki MediaSearch extensionattacker-controlled javascript license URL via XSS

Risk 26
Severity
1.2
XSS
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki MediaSearch extension allows Cross-Site Scripting (XSS).

This issue affects MediaWiki MediaSearch extension: 1.46, 1.45, and 1.43.

First published (updated )
CVE-2026-103585

Wikimedia Foundation MediaWiki CommonsMetadata extensionattacker-controlled javascript license URL via XSS

Risk 23
Severity
1.1
XSS
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Amber

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki CommonsMetadata extension allows Cross-Site Scripting (XSS).

This issue affects MediaWiki CommonsMetadata extension: 1.46, 1.45, and 1.43.

First published (updated )
CVE-2026-103584

Wikimedia Foundation MediaWiki PageTriage extensionpagetriagelist discloses suppressed reviewer usernames

Risk 26
Severity
1.2
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber

Exposure of sensitive information through data queries vulnerability in The Wikimedia Foundation MediaWiki PageTriage extension allows Information Elicitation.

This issue affects MediaWiki PageTriage extension: 1.46, 1.45, and 1.43.

First published (updated )
CVE-2026-103440

Wikimedia Foundation Wikibase ExtensionVarious rawParams() and escaped() updates to prevent XSS in Wikibase extension

Risk 20
Severity
0.3
XSS
CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikbase extension allows Cross-Site Scripting (XSS).

This issue affects MediaWiki Wikbase extension: 1.46, 1.45, and 1.43.

First published (updated )
CVE-2026-103439

Wikimedia Foundation MediaWiki Wikistories extensionVarious rawParams() and escaped() updates to prevent XSS in Wikistories extension

Risk 20
Severity
0.3
XSS
CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikistories extension allows Cross-Site Scripting (XSS).

This issue affects MediaWiki Wikistories extension: 1.46, 1.45, and 1.43.

First published (updated )
CVE-2026-103438

Wikimedia Foundation MediaWiki ReadingLists extensionReadingLists imported metadata permits JavaScript URL XSS

Risk 27
Severity
1.1
XSS
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows Reflected XSS.

This issue affects MediaWiki ReadingLists extension: 1.46 and 1.45.

First published (updated )
CVE-2026-103437

Wikimedia Foundation MediaWiki WikiLambda extensionWikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments

Risk 64
Severity
7.4
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Amber

Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass.

This issue affects MediaWiki WikiLambda extension: 1.46.

First published (updated )
CVE-2026-103446

Wikimedia Foundation MediaWiki Page FormsStored XSS through PageForms #autoedit redirect links

Risk 26
Severity
1.2
XSS
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki PageForms extension allows Stored XSS.

This issue affects MediaWiki PageForms extension: 1.46, 1.45, and 1.43.

First published (updated )
CVE-2026-103445

Wikimedia Foundation MediaWiki WikiForum extensionStored XSS through system messages in WikiForum

Risk 24
Severity
1.1
XSS
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki WikiForum extension allows Stored XSS.

This issue affects MediaWiki WikiForum extension: master.

First published (updated )
CVE-2026-103444

Wikimedia Foundation MediaWiki Collection (Book) extensionAPI permits session-seeded javascript URL XSS

Risk 25
Severity
1.1
XSS
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Collection (Book) extension allows XSS Targeting Non-Script Elements.

This issue affects MediaWiki Collection (Book) extension: 1.46, 1.45, and 1.43.

First published (updated )
CVE-2026-103443

Wikimedia Foundation MediaWiki CentralAuth ExtensionMergeAccount PHP object injection via session-key substitution

Risk 53
Severity
7.2
Code Injection
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber

External control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection.

This issue affects MediaWiki CentralAuth extension: 1.46, 1.45, and 1.43.

First published (updated )
CVE-2026-103442

Wikimedia Foundation MediaWiki Wikibase ExtensionUnauthenticated arbitrary file deletion through Wikibase serialized entity parsing

Risk 58
Severity
7.2
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:I/V:C/RE:M/U:Red

Deserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in Non-Executable Files.

This issue affects MediaWiki Wikibase extension: 1.46, 1.45, and 1.43.

First published (updated )
CVE-2026-103441

Wikimedia Foundation MediaWiki CentralNotice extensionStored i18n XSSs in CentralNotice

Risk 38
Severity
6.1
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralNotice extension allows Stored XSS.

This issue affects Mediawiki - CentralNotice extension: before 1.46.1, 1.45.5, 1.43.10.

First published (updated )
CVE-2026-103051

Wikimedia Foundation MediaWiki MassMessage extensionStored i18n XSS in MassMessage

Risk 38
Severity
6.1
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - MassMessage extension allows Stored XSS.

This issue affects Mediawiki - MassMessage extension: before 1.46.1, 1.45.5, 1.43.10.

First published (updated )
CVE-2026-103050

Wikimedia Foundation MediaWiki Cargo extensionXSS in Cargo's Special:CargoQuery page due to unsanitized table headers

Risk 38
Severity
6.1
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo extension allows Reflected XSS.

This issue affects Mediawiki - Cargo extension: before 1.46.1.

First published (updated )
CVE-2026-103049

Wikimedia Foundation MediaWiki Collection extensionOpen Redirect in Special:Book

Risk 38
Severity
6.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - Collection extension allows Fake the Source of Data.

This issue affects Mediawiki - Collection extension: before 1.46.1, 1.45.5, 1.43.10.

First published (updated )
CVE-2026-103048

Wikimedia Foundation MediaWiki CentralAuth ExtensionXSS through i18n message in CentralAuth

Risk 38
Severity
6.1
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth extension allows Stored XSS.

This issue affects Mediawiki - CentralAuth extension: before 1.46.1, 1.45.5, 1.43.10.

First published (updated )
CVE-2026-103047

Wikimedia Foundation MediaWiki Refreshed skinXSS in Refreshed skin

Risk 38
Severity
6.1
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Refreshed skin allows Stored XSS.

This issue affects Mediawiki - Refreshed skin: before 1.46.1, 1.45.5, 1.43.10.

First published (updated )
CVE-2026-103045

Wikimedia Foundation MediaWiki EasyTimeline extensionEasyTimeline should not serve image maps as application/xml

Risk 86
Severity
9.8
Path Traversal
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection.

This issue affects Mediawiki - EasyTimeline extension: before 1.46.1, 1.45.5, 1.43.10.

First published (updated )
CVE-2026-103044

Wikimedia Foundation MediaWiki - WikiLambda ExtensionWikifunctionsFragmentRenderer does unsafe string replacements on user-provided HTML

Risk 38
Severity
6.1
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation MediaWiki - WikiLambda extension allows Stored XSS.

This issue affects MediaWiki - WikiLambda extension: before 1.46.1.

First published (updated )
CVE-2026-103046

Wikimedia Foundation MediaWiki UserPageViewTracker ExtensionUnauthenticated SQL injection in UserPageViewTracker via filterusers and ignoreusers parameters

Risk 43
Severity
7.5
SQL Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wikimedia Foundation Mediawiki - UserPageViewTracker Extension allows SQL Injection.

This issue affects Mediawiki - UserPageViewTracker Extension: from before 1.46.1, 1.45.5, 1.43.10.

First published (updated )
CVE-2026-102796

Wikimedia Foundation MediaWiki Wikibase ExtensionStored XSS on Wikibase Special:SetSiteLink via unescaped system message

Risk 38
Severity
6.1
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows Stored XSS.

This issue affects Mediawiki - Wikibase Extension: from before 1.46.1, 1.45.5, 1.43.10.

First published (updated )
CVE-2026-100245

Wikimedia Foundation MediaWiki CentralAuth ExtensionCentralAuth exposes locally suppressed block information via globaluserinfo API and Special:CentralAuth (incomplete fix for CVE-2025-62669)

Risk 43
Severity
7.5
Infoleak
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows Excavation.

This issue affects Mediawiki - CentralAuth Extension: from before 1.46.1, 1.45.5, 1.43.10.

First published (updated )
CVE-2026-100244

Wikimedia Foundation MediaWiki WikiSEO ExtensionStored XSS in WikiSEO author and image properties on action=info

Risk 38
Severity
6.1
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - WikiSEO Extension allows Stored XSS.

This issue affects Mediawiki - WikiSEO Extension: from before 1.46.1, 1.45.5, 1.43.10.

First published (updated )
CVE-2026-100243

Wikimedia Foundation MediaWiki DataTransfer ExtensionDataTransfer depends on phpspreadsheet version vulnerable to CVE-2026-59933 (XLS/OLE memory exhaustion)

Risk 43
Severity
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Dependency on Vulnerable Third-Party Component and Uncontrolled Resource Consumption vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows Excessive Allocation.

This issue affects Mediawiki - DataTransfer Extension: from 1.46.0 before 1.47.0.

First published (updated )
CVE-2026-100242

Wikimedia Foundation MediaWiki - EventBus ExtensionPrivate change tags exposed to anonymous users via revision-tags-change events

Risk 43
Severity
7.5
Infoleak
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - EventBus Extension allows Excavation.

This issue affects Mediawiki - EventBus Extension: 1.47.0-alpha.

First published (updated )
CVE-2026-100241

Wikimedia Foundation MediaWiki TemplateSandbox ExtensionTemplateSandbox does not check read permissions for the page being previewed

Risk 66
Severity
9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Accessing Functionality Not Properly Constrained by ACLs.

This issue affects Mediawiki - TemplateSandbox Extension: from before 1.46.1, 1.45.5, 1.43.10.

First published (updated )
CVE-2026-100240

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203