CVEs we hold for Wikimedia

Records whose assigning authority named Wikimedia as the affected vendor. Newest identifiers first, capped at 200.

CVE-2026-8857Full RCE using EasyTimeline ExtensionWikimedia Foundation timeline

CVE-2026-58038Stored XSS through javascript URLs in SVGs generated by EasyTimelineWikimedia Foundation timeline

CVE-2026-58037Core log entries for exceptions and XSS issues in log entry formatting code that may be caused by user-controlled inputWikimedia Foundation MediaWiki

CVE-2026-58036Users API leaks whether privileged users have their user groups disabled for lack of 2FAWikimedia Foundation MediaWiki

CVE-2026-58035Stored XSS through a system message in the codex version of Special:BlockWikimedia Foundation MediaWiki

CVE-2026-58034Stored XSS through a system message when blocking a temporary account that's related to other temporary accountsWikimedia Foundation CheckUser

CVE-2026-58033"Total number of distinct authors" statistic at action=info does not exclude revisions where the author name was deletedWikimedia Foundation MediaWiki

CVE-2026-58032mw.Api.getErrorMessage() may return injected HTML if used without errorformat=htmlWikimedia Foundation MediaWiki

CVE-2026-58031Stored i18n XSS in Special:ApiSandbox when a deprecated module is selectedWikimedia Foundation MediaWiki

CVE-2026-58030SyntaxHighlight stored XSS via unsanitized 'linelinks' attributeWikimedia Foundation SyntaxHighlight_GeSHi

CVE-2026-58029Full Account Takeover from BotPasswords and OAuth via action=changeauthenticationdataWikimedia Foundation MediaWiki

CVE-2026-58028Pretty-printed API output combined with centralauthtoken allows XSS with certain gadgetsWikimedia Foundation CentralAuth

CVE-2026-58027QueryAbuseFilter API can be used to see the hit count of private filters, which is hidden in the UIWikimedia Foundation AbuseFilter

CVE-2026-58026$wgNonincludableNamespaces can be bypassed by embedding redirect in other namespacesWikimedia Foundation MediaWiki

CVE-2026-58025Remote Code Execution via Unsafe Deserialization in LogItem ImportWikimedia Foundation MediaWiki

CVE-2026-58024API identification of users on private wikisWikimedia Foundation MediaWiki

CVE-2026-5762ReportIncident DiscussionTools integration causes slow requestsWikimedia Foundation MediaWiki - ReportIncident Extension

CVE-2026-5266no title heldWikimedia Foundation Echo

CVE-2026-39841Stored XSS through list fields on Cargo's page values and Special:CargoTablesWikimedia Foundation Mediawiki - Cargo Extension

CVE-2026-39840CSS injection in multiple Cargo display formatsWikimedia Foundation Mediawiki - Cargo Extension

CVE-2026-39839Stored XSS through URLs in Cargo's map formatWikimedia Foundation Mediawiki - Cargo Extension

CVE-2026-39838ProofreadPage improperly sanitizes multiline styles using Sanitizer::checkCSSWikimedia Foundation MediaWiki - ProofreadPage Extension

CVE-2026-39837Stored XSS through the dynamic table format in CargoWikimedia Foundation Mediawiki - Cargo Extension

CVE-2026-34095action=raw with Special:Mypage subpage title responds with "Content-Type: text/html" on ctype=text/javascript requestWikimedia Foundation MediaWiki

CVE-2026-34094Customized help link for page protection indicator is relative to subpage name, because the link target is missing the…Wikimedia Foundation MediaWiki

CVE-2026-34093Special:UserRights allows viewing user rights from private wikiWikimedia Foundation MediaWiki

CVE-2026-34092Block UI elements in 'tools'-sidebar shows presence of an autoblocked IPWikimedia Foundation MediaWiki

CVE-2026-34091User localization leaked by AbuseFilter + EventStreamWikimedia Foundation MediaWiki

CVE-2026-34090Suggested investigations: Handle suppressed usernamesWikimedia Foundation CheckUser

CVE-2026-34089Memory leak in Scribunto causes runJobs.php to run out of memoryWikimedia Foundation Scribunto

CVE-2026-34088RecentChanges entries expose suppressed content via generated log page htmlWikimedia Foundation MediaWiki

CVE-2026-34087Users API leaks whether privileged users have their user groups disabled for lack of 2FAWikimedia Foundation OATHAuth

CVE-2026-34086AbuseFilter misuses ::userCanBitfield, exposing access-controlled informationWikimedia Foundation AbuseFilter

CVE-2026-13707Session fixation attacks on improperly configured OAuth 1.0a toolsWikimedia Foundation OAuth

CVE-2026-13706UrlShortener extension url validation can be bypassed due to difference between php url parsing and WHATWGWikimedia Foundation UrlShortener

CVE-2026-0817CampaignEvents API missing authorization exposes meeting and chat URLsWikimedia Foundation MediaWiki - CampaignEvents extension

CVE-2026-0671Multiple stored i18n/message-key XSSes in UploadWizardWikimedia Foundation MediaWiki - UploadWizard extension

CVE-2026-0670Stored XSS through a system message and a user-provided parameter in ProofreadPageWikimedia Foundation MediaWiki - ProofreadPage Extension

CVE-2026-0669Path Traversal vulnerability in CSS extension on certain web serversWikimedia Foundation MediaWiki - CSS extension

CVE-2026-0668VisualData extension: Regular Expression Denial of Service (ReDoS) via crafted user inputWikimedia Foundation MediaWiki - VisualData Extension

CVE-2025-7363TitleIcon: Stored Cross-Site Scripting (XSS) via #titleicon_unicode parser functionWikimedia Foundation Mediawiki - TitleIcon extension

CVE-2025-7362MsUpload: Stored Cross-Site Scripting (XSS) via unsanitized msu-continue system messageWikimedia Foundation Mediawiki - MsUpload extension

CVE-2025-7057Stored XSS in QuizWikimedia Foundation Mediawiki - Quiz Extension

CVE-2025-7056Stored XSS in UrlShortenerWikimedia Foundation Mediawiki - UrlShortener Extension

CVE-2025-6927Autoblocks from global account suppressions are publicly visibleWikimedia Foundation MediaWiki

CVE-2025-6926Security Authentication Bypass in CentralAuthWikimedia Foundation Mediawiki - CentralAuth Extension

CVE-2025-67484Action API xslt option allows JavaScript execution by administrators who are not interface administratorsWikimedia Foundation MediaWiki

CVE-2025-67483Theoretical i18n XSS in mediawiki.page.preview.js when a page has multiple protection levelsWikimedia Foundation MediaWiki

CVE-2025-67482Lua segfault in unpack()Wikimedia Foundation luasandbox

CVE-2025-67481mw.message(…).parse() doesn't output safe HTML, but it's being used as if it doesWikimedia Foundation MediaWiki

CVE-2025-67480list=allrevisions can be used to bypass Extension:LockdownWikimedia Foundation MediaWiki

CVE-2025-67479Magic word replacement in legacy parser allows using reserved data attributes through wikitextWikimedia Foundation Cite

CVE-2025-67478Wrong E-Mail address composition for usernames with a comma and Umlauts in it like "Döe, Jähn"Wikimedia Foundation CheckUser

CVE-2025-67477Stored XSS through a system message in Special:ApiSandboxWikimedia Foundation MediaWiki

CVE-2025-67476Importing leaks IP address of importer via EventStreamsWikimedia Foundation MediaWiki

CVE-2025-67475Stored XSS through edit summaries in MW CoreWikimedia Foundation MediaWiki

CVE-2025-6597MediaWiki should not consider autocreation as login for the purposes of security reauthenticationWikimedia Foundation MediaWiki

CVE-2025-6596Vector inserts portlet labels as HTML, allowing for stored XSS through system messagesWikimedia Foundation Vector

CVE-2025-6595no title heldWikimedia Foundation MultimediaViewer

CVE-2025-6594XSS in Special:ApiSandboxWikimedia Foundation MediaWiki

CVE-2025-6593"{{SITENAME}} registered email address has been changed" email sent to unverified email addressesWikimedia Foundation MediaWiki

CVE-2025-6592Creating a permanent account from a temporary account associates temp username and IP address with real username in…Wikimedia Foundation AbuseFilter

CVE-2025-6591HTML injection in API action=feedcontributions output from i18n messageWikimedia Foundation MediaWiki

CVE-2025-6590Complete content leak of private wikis due to PasswordReset Wikitext injection in error messageWikimedia Foundation MediaWiki

CVE-2025-6589With MultiBlocks enabled and a user who is suppressed via a MultiBlock, a user without 'hideuser' can see the hidden…Wikimedia Foundation MediaWiki

CVE-2025-62665Stored XSS through system messages in Skin:BlueSkyWikimedia Foundation Mediawiki - Skin:BlueSky

CVE-2025-61658Special:GlobalContributions shows edits on wikis the viewer doesn't have access toWikimedia Foundation CheckUser

CVE-2025-61657no title heldWikimedia Foundation Vector

CVE-2025-61656XSS when pasting into VEWikimedia Foundation VisualEditor

CVE-2025-61655Stored XSS through system messages in VisualEditorWikimedia Foundation VisualEditor

CVE-2025-61654UserInfoCard: Do permission checking when getting counts of global and local edits, new articles and thanksWikimedia Foundation Thanks

CVE-2025-61653Extension:TextExtracts does not check for authorizeRead when returning extractsWikimedia Foundation TextExtracts

CVE-2025-61652Action API discussiontoolspageinfo does not check for authorizeRead for the pageWikimedia Foundation DiscussionTools

CVE-2025-61651i18n XSS through Special:CheckUser CheckUser helperWikimedia Foundation CheckUser

CVE-2025-61650UserInfoCard is vulnerable to message key stored XSSWikimedia Foundation CheckUser

CVE-2025-61649UserInfoCard: Check that performing user has permission to view log entries for number of past blocksWikimedia Foundation CheckUser

CVE-2025-61648Stored XSS through system messages in CheckUserWikimedia Foundation CheckUser

CVE-2025-61647UserInfoCard: Don't allow access to information about users who are suppressed if you don't have suppressor rightsWikimedia Foundation CheckUser

CVE-2025-61646Watchlist group mode reveals authors of edits with hidden authorshipWikimedia Foundation MediaWiki

CVE-2025-61645CodexTablePager has i18n XSSWikimedia Foundation MediaWiki

CVE-2025-61644i18n XSS through Special:WatchlistWikimedia Foundation MediaWiki

CVE-2025-61643EventStreams publishes suppressed recent change entries that are suppressed from their creationWikimedia Foundation MediaWiki

CVE-2025-61642Stored XSS through system messages provided to CodexHtmlFormsWikimedia Foundation MediaWiki

CVE-2025-61641API list=allpages with maxsize is making really slow queriesWikimedia Foundation MediaWiki

CVE-2025-61640Stored XSS through system messages in Special:RecentChangesLinked (MW Core)Wikimedia Foundation MediaWiki

CVE-2025-61639Suppressed blocked IP is visible in Special:BlockList, RC, and other placesWikimedia Foundation MediaWiki

CVE-2025-61638Sanitizer::validateAttributes data-XSSWikimedia Foundation Parsoid

CVE-2025-61637Stored XSS through system messages in MW CoreWikimedia Foundation MediaWiki

CVE-2025-61636Codex Special:Block vulnerable to message key XSSWikimedia Foundation MediaWiki

CVE-2025-61635Add rate limiting to ApiFancyCaptchaReloadWikimedia Foundation ConfirmEdit

CVE-2025-61634HTML rest endpoint needs PoolCounter and proper parser cache checkWikimedia Foundation MediaWiki

CVE-2025-53502HTML injection in FeaturedFeedsWikimedia Foundation Mediawiki - FeaturedFeeds Extension

CVE-2025-53501Content Access Bypass in ScribuntoWikimedia Foundation Mediawiki - Scribunto Extension

CVE-2025-53500Stored XSS in MassEditRegexWikimedia Foundation Mediawiki - MassEditRegex Extension

CVE-2025-53499Unauthorized Inspection of Protected Variables in AbuseFilterWikimedia Foundation Mediawiki - AbuseFilter Extension

CVE-2025-53498Lack of Audit Logging in AbuseFilterWikimedia Foundation Mediawiki - AbuseFilter Extension

CVE-2025-53497Stored XSS in RelatedArticlesWikimedia Foundation Mediawiki - RelatedArticles Extension

CVE-2025-53496Stored XSS in MediaSearchWikimedia Foundation Mediawiki - MediaSearch Extension

CVE-2025-53495Unauthorized Disclosure of IP Reputation in AbuseFilterWikimedia Foundation Mediawiki - AbuseFilter Extension

CVE-2025-53494Stored XSS in TwoColConflictWikimedia Foundation Mediawiki - TwoColConflict Extension

CVE-2025-53493Stored XSS in MintyDocsWikimedia Foundation Mediawiki - MintyDocs Extension

CVE-2025-53492Stored XSS in MintyDocsWikimedia Foundation Mediawiki - MintyDocs Extension

CVE-2025-53491XSS in FlaggedRevsWikimedia Foundation Mediawiki - FlaggedRevs Extension

CVE-2025-53490Multiple XSS in CampaignEventsWikimedia Foundation Mediawiki - CampaignEvents Extension

CVE-2025-53489XSS in GoogleDocs4MWWikimedia Foundation Mediawiki - GoogleDocs4MW Extension

CVE-2025-53488Stored XSS in WikiHieroWikimedia Foundation Mediawiki - WikiHiero Extension

CVE-2025-53487ApprovedRevs: Stored Cross-Site Scripting (XSS) via unsanitized system messagesWikimedia Foundation Mediawiki - ApprovedRevs extension

CVE-2025-53486WikiCategoryTagCloud: Reflected Cross-Site Scripting (XSS) via linkstyle attribute in parser functionWikimedia Foundation Mediawiki - WikiCategoryTagCloud…

CVE-2025-53485SecurePoll: Unauthorized access to SetTranslationHandler allows arbitrary text changesWikimedia Foundation Mediawiki - SecurePoll extension

CVE-2025-53484SecurePoll: Multiple locations vulnerable to Cross-Site Scripting (XSS) via unescaped inputWikimedia Foundation Mediawiki - SecurePoll extension

CVE-2025-53483SecurePoll: Multiple admin actions vulnerable to Cross-Site Request ForgeryWikimedia Foundation Mediawiki - SecurePoll extension

CVE-2025-53482IPInfo: Message key XSS through several IPInfo messages in infobox and popupWikimedia Foundation Mediawiki - IPInfo Extension

CVE-2025-53481Denial of service vector on ipinfo/v0/norevisionWikimedia Foundation Mediawiki - IPInfo Extension

CVE-2025-53480CheckUser: Reflected Cross-Site Scripting (XSS) in Special:Investigate (Account information tab) via unsanitized i18n…Wikimedia Foundation Mediawiki - CheckUser extension

CVE-2025-53479CheckUser: Reflected Cross-Site Scripting (XSS) in Special:CheckUser via unsanitized internationalized messageWikimedia Foundation Mediawiki - CheckUser extension

CVE-2025-53478CheckUser: Reflected Cross-Site Scripting (XSS) in Special:Investigate via unsanitized i18n messagesWikimedia Foundation Mediawiki - CheckUser extension

CVE-2025-52738WordPress Wikipedia Preview plugin <= 1.15.0 - Broken Access Control vulnerabilityWikimedia Foundation Wikipedia Preview

CVE-2025-3469i18n XSS vulnerability in HTMLMultiSelectField when sections are usedWikimedia Foundation MediaWiki

CVE-2025-32700AbuseFilter log interfaces expose global private and hidden filters when central DB is not availableWikimedia Foundation MediaWiki

CVE-2025-32699Potential javascript injection attack enabled by Unicode normalization in Action APIWikimedia Foundation Parsoid

CVE-2025-32698LogPager.php: Restriction enforcer functions do not correctly enforce suppression restrictionsWikimedia Foundation MediaWiki

CVE-2025-32697Cascading protection is not preventing file reversionsWikimedia Foundation MediaWiki

CVE-2025-32696"reupload-own" restriction can be bypassed by reverting fileWikimedia Foundation MediaWiki

CVE-2025-23081Various security vulnerabilities in Extension:DataTransferWikimedia Foundation Mediawiki - DataTransfer Extension

CVE-2025-23080XSSes in Special:BadgeViewWikimedia Foundation Mediawiki - OpenBadges Extension

CVE-2025-23079XSSes in Extension:ArticleFeedbackv5Wikimedia Foundation Mediawiki - ArticleFeedbackv5 extension

CVE-2025-23078XSS in BreadCrumbs2Wikimedia Foundation Mediawiki - Breadcrumbs2 extension

CVE-2025-23074Special:EditProfile exposes the contents of profile fields marked "hidden"/friends or "friends of friends" when the…Wikimedia Foundation Mediawiki - SocialProfile Extension

CVE-2025-23073API list=globalblocks can reveal IP of autoblock if username and IP are included in the bgtargets parameterWikimedia Foundation Mediawiki - GlobalBlocking Extension

CVE-2025-23072XSS in Special:RefreshSpecialWikimedia Foundation Mediawiki - RefreshSpecial Extension

CVE-2025-11261Stored i18n XSS exposed by security patch for T402077Wikimedia Foundation MediaWiki

CVE-2025-11173Reauth for enabling 2FA can be bypassed by submitting a formWikimedia Foundation OATHAuth

CVE-2018-25065Wikimedia mediawiki-extensions-I18nTags Unlike Parser I18nTags_body.php cross site scriptingWikimedia mediawiki-extensions-I18nTags

CVE-2013-6455no title heldWikimedia Foundation MediaWiki

CVE-2013-6451no title heldWikimedia Foundation MediaWiki

CVE-2013-4572no title heldWikimedia Foundation MediaWiki

CVE-2013-4303no title heldWikimedia Foundation MediaWiki

137 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.