The Wikimedia Foundation MediaWiki Cargo extension

• CVE-2026-103049 Medium 6.1 XSS in Cargo's Special:CargoQuery page due to unsanitized table headers 0.2%
• CVE-2026-96878 Medium 6.9 Cargo Exhibit field alias allows stored XSS 0.3%
• CVE-2026-96877 Medium 6.9 Reflected XSS through Cargo Drilldown full-text search 0.3%
• CVE-2026-96876 Medium 6.9 Anonymous reflected XSS in CargoExport invalid-alias errors 0.3%
• CVE-2026-96875 Medium 6.9 Reflected XSS in Cargo Drilldown hierarchy filters 0.3%
• CVE-2026-96874 Low 2.3 Stored XSS in Cargo Drilldown tab names 0.3%
• CVE-2026-14363 Medium 6.9 Cargo Extension: SQLi in Special:Drilldown 0.5%
• CVE-2026-58521 Medium 6.9 SQLi in Cargo extension via year range filter 0.6%
• CVE-2026-58519 Medium 6.9 Stored XSS through Cargo's map format 0.2%
• CVE-2025-62671 Medium 6.9 Stored XSS through wikitext in Cargo 0.5%
• CVE-2025-62655 Low 2.1 SQL injection in Cargo via Special:CargoExport 0.3%