mediawiki

Top products

The 15 most recently published vulnerabilities affecting mediawiki.

• CVE-2026-14363Cargo Extension: SQLi in Special:Drilldown9.8Jul 1, 2026
• CVE-2026-14358Stored XSS in Wikimedia Chart pie tooltip via Data:*.tab field title6.1Jul 1, 2026
• CVE-2026-58517Blocked users can create and edit WikiLambda objects4.3Jul 1, 2026
• CVE-2026-58521SQLi in Cargo extension via year range filter9.8Jul 1, 2026
• CVE-2026-58520UrlShortener defaults to ineffective validation open to third-party redirects6.1Jul 1, 2026
• CVE-2026-58025Remote Code Execution via Unsafe Deserialization in LogItem Import9.8Jul 1, 2026
• CVE-2026-58029Full Account Takeover from BotPasswords and OAuth via action=changeauthenticationdata6.5Jul 1, 2026
• CVE-2026-58028Pretty-printed API output combined with centralauthtoken allows XSS with certain gadgets5.4Jul 1, 2026
• CVE-2026-58026$wgNonincludableNamespaces can be bypassed by embedding redirect in other namespaces5.7Jul 1, 2026
• CVE-2026-8857Full RCE using EasyTimeline Extension8.8Jul 1, 2026
• CVE-2026-58038Stored XSS through javascript URLs in SVGs generated by EasyTimeline6.1Jul 1, 2026
• CVE-2026-58027QueryAbuseFilter API can be used to see the hit count of private filters, which is hidden in the UI6.5Jul 1, 2026
• CVE-2026-58030SyntaxHighlight stored XSS via unsanitized 'linelinks' attribute6.1Jul 1, 2026
• CVE-2026-58032mw.Api.getErrorMessage() may return injected HTML if used without errorformat=html6.1Jul 1, 2026
• CVE-2026-58033"Total number of distinct authors" statistic at action=info does not exclude revisions where the author name was deleted6.5Jul 1, 2026