Wikimedia Foundation

Products

Exploited and recent CVEs

• CVE-2026-102796 High 7.5 Unauthenticated SQL injection in UserPageViewTracker via filterusers and ignoreusers parameters 0.3%
• CVE-2026-100245 Medium 6.1 Stored XSS on Wikibase Special:SetSiteLink via unescaped system message 0.2%
• CVE-2026-100244 High 7.5 CentralAuth exposes locally suppressed block information via globaluserinfo API and Special:CentralAuth (incomplete fix for CVE-2025-62669) 0.3%
• CVE-2026-100243 Medium 6.1 Stored XSS in WikiSEO author and image properties on action=info 0.2%
• CVE-2026-100242 High 7.5 DataTransfer depends on phpspreadsheet version vulnerable to CVE-2026-59933 (XLS/OLE memory exhaustion) 0.4%
• CVE-2026-100241 High 7.5 Private change tags exposed to anonymous users via revision-tags-change events 0.3%
• CVE-2026-100240 Critical 9.1 TemplateSandbox does not check read permissions for the page being previewed 0.3%
• CVE-2026-100238 Medium 6.1 Flow colon-separator and flow-guidedtour-optin-welcome-description messages allow stored XSS 0.2%
• CVE-2026-100383 Medium 4.8 Stored i18n XSS in WikiLambda's VisualEditor integration 0.3%
• CVE-2026-100382 Critical 10.0 Unauthenticated remote code execution through wikitext in ExternalData 1.2%
• CVE-2026-100381 Medium 5.3 UploadWizard Flickr collection and set titles allow DOM XSS 0.4%
• CVE-2026-100380 Medium 5.3 Reflected XSS in Wikibase Special:SetLabel language validation 0.4%
• CVE-2026-100379 Medium 5.3 Cross-request disclosure of CentralAuth cookies in Wikipedia Android App 0.4%
• CVE-2026-100378 Medium 5.3 Missing permission check in the Translate sandbox doRemind action 0.3%
• CVE-2026-100376 Medium 4.8 TemplateSandbox can be abused for XSS by asking another user to preview a page with a certain sandbox prefix 0.3%
• CVE-2026-100377 Medium 6.9 Revision-deleted pages can be viewed through WikiLambda's action=edit and Special:ViewAbstract 0.3%
• CVE-2026-58025 Medium 5.9 Remote Code Execution via Unsafe Deserialization in LogItem Import 0.5%
• CVE-2026-58029 Medium 5.3 Full Account Takeover from BotPasswords and OAuth via action=changeauthenticationdata 0.4%
• CVE-2026-58028 None 0.0 Pretty-printed API output combined with centralauthtoken allows XSS with certain gadgets 0.3%
• CVE-2026-58028 None 0.0 Pretty-printed API output combined with centralauthtoken allows XSS with certain gadgets 0.3%
• CVE-2026-58026 None 0.0 $wgNonincludableNamespaces can be bypassed by embedding redirect in other namespaces 0.4%
• CVE-2026-8857 None 0.0 Full RCE using EasyTimeline Extension 2.1%
• CVE-2026-58038 None 0.0 Stored XSS through javascript URLs in SVGs generated by EasyTimeline 0.3%
• CVE-2026-58027 Medium 5.3 QueryAbuseFilter API can be used to see the hit count of private filters, which is hidden in the UI 0.4%
• CVE-2026-58030 Medium 5.3 SyntaxHighlight stored XSS via unsanitized 'linelinks' attribute 0.3%
• CVE-2026-58032 Medium 5.3 mw.Api.getErrorMessage() may return injected HTML if used without errorformat=html 0.3%
• CVE-2026-58033 Medium 5.3 "Total number of distinct authors" statistic at action=info does not exclude revisions where the author name was deleted 0.4%
• CVE-2026-58037 None 0.0 Core log entries for exceptions and XSS issues in log entry formatting code that may be caused by user-controlled input 0.3%
• CVE-2026-58036 Low 2.1 Users API leaks whether privileged users have their user groups disabled for lack of 2FA 0.3%
• CVE-2026-58024 Medium 5.1 API identification of users on private wikis 0.4%