The Wikimedia Foundation MediaWiki WikiLambda extension

• CVE-2026-103446 High 7.4 WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments 0.3%
• CVE-2026-103046 Medium 6.1 WikifunctionsFragmentRenderer does unsafe string replacements on user-provided HTML 0.2%
• CVE-2026-96872 Low 2.9 WikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositions 0.3%
• CVE-2026-58517 Medium 6.9 Blocked users can create and edit WikiLambda objects 0.3%
• CVE-2025-62695 Medium 6.9 Stored XSS through system messages 0.4%