TThe Wikimedia Foundation

Products

Exploited and recent CVEs

• CVE-2026-103585 Low 1.2 attacker-controlled javascript license URL via XSS 0.3%
• CVE-2026-103584 Low 1.1 attacker-controlled javascript license URL via XSS 0.3%
• CVE-2026-103440 Low 1.2 pagetriagelist discloses suppressed reviewer usernames 0.3%
• CVE-2026-103439 Low 0.3 Various rawParams() and escaped() updates to prevent XSS in Wikibase extension 0.1%
• CVE-2026-103438 Low 0.3 Various rawParams() and escaped() updates to prevent XSS in Wikistories extension 0.1%
• CVE-2026-103437 Low 1.1 ReadingLists imported metadata permits JavaScript URL XSS 0.3%
• CVE-2026-103446 High 7.4 WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments 0.3%
• CVE-2026-103445 Low 1.2 Stored XSS through PageForms #autoedit redirect links 0.3%
• CVE-2026-103444 Low 1.1 Stored XSS through system messages in WikiForum 0.3%
• CVE-2026-103443 Low 1.1 API permits session-seeded javascript URL XSS 0.2%
• CVE-2026-103442 High 7.2 MergeAccount PHP object injection via session-key substitution 0.3%
• CVE-2026-103441 High 7.2 Unauthenticated arbitrary file deletion through Wikibase serialized entity parsing 0.3%
• CVE-2026-103051 Medium 6.1 Stored i18n XSSs in CentralNotice 0.2%
• CVE-2026-103050 Medium 6.1 Stored i18n XSS in MassMessage 0.2%
• CVE-2026-103049 Medium 6.1 XSS in Cargo's Special:CargoQuery page due to unsanitized table headers 0.2%
• CVE-2026-103048 Medium 6.1 Open Redirect in Special:Book 0.1%
• CVE-2026-103047 Medium 6.1 XSS through i18n message in CentralAuth 0.2%
• CVE-2026-103045 Medium 6.1 XSS in Refreshed skin 0.2%
• CVE-2026-103044 Critical 9.8 EasyTimeline should not serve image maps as application/xml 0.4%
• CVE-2026-103046 Medium 6.1 WikifunctionsFragmentRenderer does unsafe string replacements on user-provided HTML 0.2%
• CVE-2026-96879 Medium 6.9 "Checked by" label in page history should not be shown if the underlying review log entry is suppressed" 0.3%
• CVE-2026-96878 Medium 6.9 Cargo Exhibit field alias allows stored XSS 0.3%
• CVE-2026-96877 Medium 6.9 Reflected XSS through Cargo Drilldown full-text search 0.3%
• CVE-2026-96876 Medium 6.9 Anonymous reflected XSS in CargoExport invalid-alias errors 0.3%
• CVE-2026-96875 Medium 6.9 Reflected XSS in Cargo Drilldown hierarchy filters 0.3%
• CVE-2026-100237 Medium 6.1 Stored i18n XSS in the Flow integration of Thanks 0.2%
• CVE-2026-96874 Low 2.3 Stored XSS in Cargo Drilldown tab names 0.3%
• CVE-2026-96873 Medium 5.5 Reflected XSS in CirrusSearch debug explain output 0.3%
• CVE-2026-96872 Low 2.9 WikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositions 0.3%
• CVE-2026-14363 Medium 6.9 Cargo Extension: SQLi in Special:Drilldown 0.5%