Wikimedia Foundation MediaWiki

• CVE-2026-58025 Medium 5.9 Remote Code Execution via Unsafe Deserialization in LogItem Import 0.5%
• CVE-2026-58029 Medium 5.3 Full Account Takeover from BotPasswords and OAuth via action=changeauthenticationdata 0.4%
• CVE-2026-58028 None 0.0 Pretty-printed API output combined with centralauthtoken allows XSS with certain gadgets 0.3%
• CVE-2026-58026 None 0.0 $wgNonincludableNamespaces can be bypassed by embedding redirect in other namespaces 0.4%
• CVE-2026-58032 Medium 5.3 mw.Api.getErrorMessage() may return injected HTML if used without errorformat=html 0.3%
• CVE-2026-58033 Medium 5.3 "Total number of distinct authors" statistic at action=info does not exclude revisions where the author name was deleted 0.4%
• CVE-2026-58037 None 0.0 Core log entries for exceptions and XSS issues in log entry formatting code that may be caused by user-controlled input 0.3%
• CVE-2026-58036 Low 2.1 Users API leaks whether privileged users have their user groups disabled for lack of 2FA 0.3%
• CVE-2026-58024 Medium 5.1 API identification of users on private wikis 0.4%
• CVE-2026-58031 None 0.0 Stored i18n XSS in Special:ApiSandbox when a deprecated module is selected 0.3%
• CVE-2026-58035 None 0.0 Stored XSS through a system message in the codex version of Special:Block 0.3%
• CVE-2026-34095 None 0.0 action=raw with Special:Mypage subpage title responds with "Content-Type: text/html" on ctype=text/javascript request 0.2%
• CVE-2026-34094 Low 2.0 Customized help link for page protection indicator is relative to subpage name, because the link target is missing the "/wiki/" prefix 0.2%
• CVE-2026-34093 Low 1.1 Special:UserRights allows viewing user rights from private wiki 0.2%
• CVE-2026-34092 Low 2.1 Block UI elements in 'tools'-sidebar shows presence of an autoblocked IP 0.2%
• CVE-2026-34091 Medium 5.5 User localization leaked by AbuseFilter + EventStream 0.3%
• CVE-2026-34088 Low 1.3 RecentChanges entries expose suppressed content via generated log page html 0.3%
• CVE-2025-67481 None 0.0 mw.message(…).parse() doesn't output safe HTML, but it's being used as if it does 0.3%
• CVE-2025-67483 None 0.0 Theoretical i18n XSS in mediawiki.page.preview.js when a page has multiple protection levels 0.3%
• CVE-2025-67484 None 0.0 Action API xslt option allows JavaScript execution by administrators who are not interface administrators 0.4%
• CVE-2025-67480 None 0.0 list=allrevisions can be used to bypass Extension:Lockdown 0.3%
• CVE-2025-67475 None 0.0 Stored XSS through edit summaries in MW Core 0.2%
• CVE-2025-67476 Low 1.3 Importing leaks IP address of importer via EventStreams 0.3%
• CVE-2025-67477 None 0.0 Stored XSS through a system message in Special:ApiSandbox 0.2%
• CVE-2025-67479 None 0.0 Magic word replacement in legacy parser allows using reserved data attributes through wikitext 0.3%
• CVE-2025-11261 None 0.0 Stored i18n XSS exposed by security patch for T402077 0.3%
• CVE-2025-61645 None 0.0 CodexTablePager has i18n XSS 0.2%
• CVE-2025-61646 Low 1.2 Watchlist group mode reveals authors of edits with hidden authorship 0.3%
• CVE-2025-61644 None 0.0 i18n XSS through Special:Watchlist 0.3%
• CVE-2025-61637 None 0.0 Stored XSS through system messages in MW Core 0.3%
• CVE-2025-61638 None 0.0 Sanitizer::validateAttributes data-XSS 0.3%
• CVE-2025-61639 Low 1.7 Suppressed blocked IP is visible in Special:BlockList, RC, and other places 0.3%
• CVE-2025-61640 None 0.0 Stored XSS through system messages in Special:RecentChangesLinked (MW Core) 0.2%
• CVE-2025-61641 Low 1.7 API list=allpages with maxsize is making really slow queries 0.3%
• CVE-2025-61642 None 0.0 Stored XSS through system messages provided to CodexHtmlForms 0.3%
• CVE-2025-61643 Low 2.7 EventStreams publishes suppressed recent change entries that are suppressed from their creation 0.3%
• CVE-2025-61634 None 0.0 HTML rest endpoint needs PoolCounter and proper parser cache check 0.3%
• CVE-2025-61636 None 0.0 Codex Special:Block vulnerable to message key XSS 0.2%
• CVE-2025-6589 Low 2.1 With MultiBlocks enabled and a user who is suppressed via a MultiBlock, a user without 'hideuser' can see the hidden username in the BlockList 0.5%
• CVE-2025-6590 Medium 4.6 Complete content leak of private wikis due to PasswordReset Wikitext injection in error message 0.4%
• CVE-2025-6591 None 0.0 HTML injection in API action=feedcontributions output from i18n message 0.4%
• CVE-2025-6593 Low 2.1 "{{SITENAME}} registered email address has been changed" email sent to unverified email addresses 0.4%
• CVE-2025-6594 Medium 4.7 XSS in Special:ApiSandbox 0.3%
• CVE-2025-6597 None 0.0 MediaWiki should not consider autocreation as login for the purposes of security reauthentication 0.5%
• CVE-2025-6927 Low 2.3 Autoblocks from global account suppressions are publicly visible 0.5%
• CVE-2025-32700 Low 2.3 AbuseFilter log interfaces expose global private and hidden filters when central DB is not available 0.4%
• CVE-2025-32699 Low 2.1 Potential javascript injection attack enabled by Unicode normalization in Action API 0.4%
• CVE-2025-32698 Low 2.1 LogPager.php: Restriction enforcer functions do not correctly enforce suppression restrictions 0.4%
• CVE-2025-32697 None 0.0 Cascading protection is not preventing file reversions 0.4%
• CVE-2025-32696 None 0.0 "reupload-own" restriction can be bypassed by reverting file 0.4%