[ Vendor · 29 CVEs ]
The Wikimedia Foundation
CVEs affecting The Wikimedia Foundation published in the last 30 days, plus any The Wikimedia Foundation CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-103584 | 30 Sep 2026 | CVSS 1.1 | The Wikimedia Foundation MediaWiki CommonsMetadata extensionImproper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki CommonsMetadata… | |
| CVE-2026-103585 | 30 Sep 2026 | CVSS 1.2 | The Wikimedia Foundation MediaWiki MediaSearch extensionImproper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki MediaSearch… | |
| CVE-2026-103446 | 30 Sep 2026 | CVSS 7.4 | The Wikimedia Foundation MediaWiki WikiLambda extensionAuthorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication… | |
| CVE-2026-103437 | 30 Sep 2026 | CVSS 1.1 | The Wikimedia Foundation MediaWiki ReadingLists extensionImproper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki ReadingLists… | |
| CVE-2026-103438 | 30 Sep 2026 | CVSS 0.3 | The Wikimedia Foundation MediaWiki Wikistories extensionImproper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikistories… | |
| CVE-2026-103439 | 30 Sep 2026 | CVSS 0.3 | The Wikimedia Foundation MediaWiki Wikbase extensionImproper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikbase extension… | |
| CVE-2026-103440 | 30 Sep 2026 | CVSS 1.2 | The Wikimedia Foundation MediaWiki PageTriage extensionExposure of sensitive information through data queries vulnerability in The Wikimedia Foundation MediaWiki PageTriage extension allows Information… | |
| CVE-2026-103445 | 30 Sep 2026 | CVSS 1.2 | The Wikimedia Foundation MediaWiki Page_Forms extensionImproper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Page_Forms… | |
| CVE-2026-103443 | 30 Sep 2026 | CVSS 1.1 | The Wikimedia Foundation MediaWiki Collection (Book) extensionImproper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Collection (Book)… | |
| CVE-2026-103444 | 30 Sep 2026 | CVSS 1.1 | The Wikimedia Foundation MediaWiki WikiForum extensionImproper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki WikiForum extension… | |
| CVE-2026-103442 | 30 Sep 2026 | CVSS 7.2 | The Wikimedia Foundation MediaWiki CentralAuth extensionExternal control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection… | |
| CVE-2026-103441 | 30 Sep 2026 | CVSS 7.2 | The Wikimedia Foundation MediaWiki Wikibase extensionDeserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in… | |
| CVE-2026-103048 | 30 Sep 2026 | CVSS 6.1 | The Wikimedia Foundation Mediawiki - Collection extensionURL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - Collection extension allows Fake the Source… | |
| CVE-2026-103049 | 30 Sep 2026 | CVSS 6.1 | The Wikimedia Foundation Mediawiki - Cargo extensionImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo… | |
| CVE-2026-103050 | 30 Sep 2026 | CVSS 6.1 | The Wikimedia Foundation Mediawiki - MassMessage extensionImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki -… | |
| CVE-2026-103051 | 30 Sep 2026 | CVSS 6.1 | The Wikimedia Foundation Mediawiki - CentralNotice extensionImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki -… | |
| CVE-2026-103044 | 29 Sep 2026 | CVSS 9.8 | The Wikimedia Foundation Mediawiki - EasyTimeline extensionXML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection. This… | |
| CVE-2026-103045 | 29 Sep 2026 | CVSS 6.1 | The Wikimedia Foundation Mediawiki - Refreshed skinImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Refreshed… | |
| CVE-2026-103046 | 29 Sep 2026 | CVSS 6.1 | The Wikimedia Foundation Mediawiki - WikiLambda ExtensionImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation MediaWiki - WikiLambda… | |
| CVE-2026-103047 | 29 Sep 2026 | CVSS 6.1 | The Wikimedia Foundation Mediawiki - CentralAuth extensionImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki -… | |
| CVE-2026-96879 | 25 Sep 2026 | CVSS 6.9 | The Wikimedia Foundation Mediawiki - FlaggedRevs extensionImproper removal of sensitive information before storage or transfer vulnerability in Wikimedia Foundation's Mediawiki - FlaggedRevs extension… | |
| CVE-2026-96877 | 25 Sep 2026 | CVSS 6.9 | The Wikimedia Foundation Mediawiki - Cargo extensionImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected… | |
| CVE-2026-96878 | 25 Sep 2026 | CVSS 6.9 | The Wikimedia Foundation Mediawiki - Cargo extensionImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected… | |
| CVE-2026-96875 | 25 Sep 2026 | CVSS 6.9 | The Wikimedia Foundation Mediawiki - Cargo extensionImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Stored XSS… | |
| CVE-2026-96876 | 25 Sep 2026 | CVSS 6.9 | The Wikimedia Foundation Mediawiki - Cargo extensionImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected… | |
| CVE-2026-100237 | 25 Sep 2026 | CVSS 6.1 | The Wikimedia Foundation Mediawiki - Thanks ExtensionImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Thanks… | |
| CVE-2026-96874 | 25 Sep 2026 | CVSS 2.3 | The Wikimedia Foundation Mediawiki - Cargo extensionImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in the Mediawiki - Cargo extension allows Stored… | |
| CVE-2026-96873 | 24 Sep 2026 | CVSS 5.5 | The Wikimedia Foundation Mediawiki - CirrusSearch ExtensionImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - CirrusSearch extension allows… | |
| CVE-2026-96872 | 23 Sep 2026 | CVSS 2.9 | The Wikimedia Foundation Mediawiki - WikiLambda ExtensionImproper handling of insufficient permissions or privileges vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension on Linux… |