The Wikimedia Foundation
Vulnerability activity for The Wikimedia Foundation: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 18
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 18
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 7.2HighSep 30, 2026The Wikimedia Foundation MediaWiki CentralAuth extension Code / command injectionCVE-2026-103442External control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection. This issue affects MediaWiki CentralAuth extension: 1.46, 1.45, and 1.43.
- 7.2HighSep 30, 2026The Wikimedia Foundation MediaWiki Wikibase extension DeserializationCVE-2026-103441Deserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in Non-Executable Files. This issue affects MediaWiki Wikibase extension: 1.46, 1.45, and 1.43.
- 6.1MediumSep 30, 2026The Wikimedia Foundation Mediawiki - CentralNotice extension XSSCVE-2026-103051Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralNotice extension allows Stored XSS. This issue affects Mediawiki - CentralNotice extension: before 1.46.1, 1.45.5, 1.43.10.
- 6.1MediumSep 30, 2026The Wikimedia Foundation Mediawiki - MassMessage extension XSSCVE-2026-103050Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - MassMessage extension allows Stored XSS. This issue affects Mediawiki - MassMessage extension: before 1.46.1, 1.45.5, 1.43.10.
- 6.1MediumSep 30, 2026The Wikimedia Foundation Mediawiki - Cargo extension XSSCVE-2026-103049Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: before 1.46.1.
- 6.1MediumSep 30, 2026The Wikimedia Foundation Mediawiki - Collection extensionCVE-2026-103048URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - Collection extension allows Fake the Source of Data. This issue affects Mediawiki - Collection extension: before 1.46.1, 1.45.5, 1.43.10.
- 6.1MediumSep 29, 2026The Wikimedia Foundation Mediawiki - CentralAuth extension XSSCVE-2026-103047Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth extension allows Stored XSS. This issue affects Mediawiki - CentralAuth extension: before 1.46.1, 1.45.5, 1.43.10.
- 6.1MediumSep 29, 2026The Wikimedia Foundation Mediawiki - WikiLambda Extension XSSCVE-2026-103046Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation MediaWiki - WikiLambda extension allows Stored XSS. This issue affects MediaWiki - WikiLambda extension: before 1.46.1.
- 6.1MediumSep 29, 2026The Wikimedia Foundation Mediawiki - Refreshed skin XSSCVE-2026-103045Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Refreshed skin allows Stored XSS. This issue affects Mediawiki - Refreshed skin: before 1.46.1, 1.45.5, 1.43.10.
- 9.8CriticalSep 29, 2026The Wikimedia Foundation Mediawiki - EasyTimeline extensionCVE-2026-103044XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection. This issue affects Mediawiki - EasyTimeline extension: before 1.46.1, 1.45.5, 1.43.10.
- 6.9MediumSep 25, 2026The Wikimedia Foundation Mediawiki - FlaggedRevs extension Information disclosureCVE-2026-96879Improper removal of sensitive information before storage or transfer vulnerability in Wikimedia Foundation's Mediawiki - FlaggedRevs extension through 1.46.0.
- 6.9MediumSep 25, 2026The Wikimedia Foundation Mediawiki - Cargo extension XSSCVE-2026-96878Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.
- 6.9MediumSep 25, 2026The Wikimedia Foundation Mediawiki - Cargo extension XSSCVE-2026-96877Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.
- 6.9MediumSep 25, 2026The Wikimedia Foundation Mediawiki - Cargo extension XSSCVE-2026-96876Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.
- 6.9MediumSep 25, 2026The Wikimedia Foundation Mediawiki - Cargo extension XSSCVE-2026-96875Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.
- 6.1MediumSep 25, 2026The Wikimedia Foundation Mediawiki - Thanks Extension XSSCVE-2026-100237Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Thanks Extension allows Stored XSS. This issue affects Mediawiki - Thanks Extension: from * before 1.43.10/1.45.5/1.46.1.
- 2.3LowSep 25, 2026The Wikimedia Foundation Mediawiki - Cargo extension XSSCVE-2026-96874Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in the Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.
- 2.9LowSep 23, 2026The Wikimedia Foundation Mediawiki - WikiLambda ExtensionCVE-2026-96872Improper handling of insufficient permissions or privileges vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension on Linux, MacOS, and Windows allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - WikiLambda Extension: before 1.47.0.
Top products
- Mediawiki - Cargo extension6 CVEs in the last year
- Mediawiki - WikiLambda Extension2 CVEs in the last year
- MediaWiki Wikibase extension1 CVE in the last year
- MediaWiki CentralAuth extension1 CVE in the last year
- Mediawiki - Thanks Extension1 CVE in the last year
- Mediawiki - Refreshed skin1 CVE in the last year
- Mediawiki - MassMessage extension1 CVE in the last year
- Mediawiki - FlaggedRevs extension1 CVE in the last year
- Mediawiki - EasyTimeline extension1 CVE in the last year, 1 critical
- Mediawiki - Collection extension1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.