Where
-Infinity
0

Trending

Last week
Last month
Last year

MediaWiki MediaWikiRemote Code Execution via Unsafe Deserialization in LogItem Import

Risk 86
Severity
5.9
First published (updated )
CVE-2026-58025

MediaWiki MediaWikiFull Account Takeover from BotPasswords and OAuth via action=changeauthenticationdata

Risk 40
Severity
5.3
First published (updated )
CVE-2026-58029

Wikimedia Foundation MediaWikiPretty-printed API output combined with centralauthtoken allows XSS with certain gadgets

Risk 34
Severity
First published (updated )
CVE-2026-58028

MediaWiki MediaWiki$wgNonincludableNamespaces can be bypassed by embedding redirect in other namespaces

Risk 33
Severity
First published (updated )
CVE-2026-58026

MediaWiki MediaWikimw.Api.getErrorMessage() may return injected HTML if used without errorformat=html

Risk 38
Severity
5.3
First published (updated )
CVE-2026-58032
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

MediaWiki MediaWiki"Total number of distinct authors" statistic at action=info does not exclude revisions where the author name was deleted

Risk 37
Severity
5.3
First published (updated )
CVE-2026-58033

MediaWiki MediaWikiCore log entries for exceptions and XSS issues in log entry formatting code that may be caused by user-controlled input

Risk 38
Severity
First published (updated )
CVE-2026-58037

Wikimedia Foundation MediaWikiUsers API leaks whether privileged users have their user groups disabled for lack of 2FA

Risk 43
Severity
2.1
First published (updated )
CVE-2026-58036

MediaWiki MediaWikiAPI identification of users on private wikis

Risk 33
Severity
5.1
First published (updated )
CVE-2026-58024

Wikimedia Foundation MediaWikiStored i18n XSS in Special:ApiSandbox when a deprecated module is selected

Risk 34
Severity
First published (updated )
CVE-2026-58031
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Wikimedia Foundation MediaWikiStored XSS through a system message in the codex version of Special:Block

Risk 29
Severity
First published (updated )
CVE-2026-58035

Wikimedia Foundation MediaWiki 1.46End of life details

EOL
Jul 31, 2027
First published (updated )
EOL-mediawiki-1.46

MediaWiki MediaWikiaction=raw with Special:Mypage subpage title responds with "Content-Type: text/html" on ctype=text/javascript request

Risk 38
Severity
First published (updated )
CVE-2026-34095

MediaWiki MediaWikiCustomized help link for page protection indicator is relative to subpage name, because the link target is missing the "/wiki/" prefix

Risk 26
Severity
2
First published (updated )
CVE-2026-34094

MediaWiki MediaWikiSpecial:UserRights allows viewing user rights from private wiki

Risk 27
Severity
1.1
First published (updated )
CVE-2026-34093
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

MediaWiki MediaWikiBlock UI elements in 'tools'-sidebar shows presence of an autoblocked IP

Risk 43
Severity
2.1
First published (updated )
CVE-2026-34092

MediaWiki MediaWikiUser localization leaked by AbuseFilter + EventStream

Risk 43
Severity
5.5
First published (updated )
CVE-2026-34091

MediaWiki MediaWikiRecentChanges entries expose suppressed content via generated log page html

Risk 43
Severity
1.3
First published (updated )
CVE-2026-34088

MediaWiki MediaWikimw.message(…).parse() doesn't output safe HTML, but it's being used as if it does

Risk 38
Severity
First published (updated )
CVE-2025-67481

MediaWiki MediaWikiTheoretical i18n XSS in mediawiki.page.preview.js when a page has multiple protection levels

Risk 38
Severity
First published (updated )
CVE-2025-67483
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

MediaWiki MediaWikiAction API xslt option allows JavaScript execution by administrators who are not interface administrators

Risk 86
Severity
First published (updated )
CVE-2025-67484

MediaWiki MediaWikilist=allrevisions can be used to bypass Extension:Lockdown

Risk 38
Severity
First published (updated )
CVE-2025-67480

MediaWiki MediaWikiStored XSS through edit summaries in MW Core

Risk 38
Severity
First published (updated )
CVE-2025-67475

MediaWiki MediaWikiImporting leaks IP address of importer via EventStreams

Risk 22
Severity
1.3
First published (updated )
CVE-2025-67476

MediaWiki MediaWikiStored XSS through a system message in Special:ApiSandbox

Risk 38
Severity
First published (updated )
CVE-2025-67477
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Wikimedia Foundation MediaWikiMagic word replacement in legacy parser allows using reserved data attributes through wikitext

Risk 3
Severity
1
First published (updated )
CVE-2025-67479

MediaWiki MediaWikiStored i18n XSS exposed by security patch for T402077

Risk 38
Severity
First published (updated )
CVE-2025-11261

Wikimedia Foundation MediaWikiCodexTablePager has i18n XSS

Risk 38
Severity
6.1
First published (updated )
CVE-2025-61645

MediaWiki MediaWikiWatchlist group mode reveals authors of edits with hidden authorship

Risk 34
Severity
1.2
First published (updated )
CVE-2025-61646

Wikimedia Foundation MediaWikii18n XSS through Special:Watchlist

Risk 3
Severity
1
First published (updated )
CVE-2025-61644
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203