Wikimedia Foundation
Vulnerability activity for Wikimedia Foundation: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 16
- Critical (CVSS 9+)
- 2
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 16
- Critical (CVSS 9+)
- 2
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 7.5HighSep 29, 2026Wikimedia Foundation Mediawiki - UserPageViewTracker Extension SQL injectionCVE-2026-102796Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wikimedia Foundation Mediawiki - UserPageViewTracker Extension allows SQL Injection. This issue affects Mediawiki - UserPageViewTracker Extension: from * before 1.46.1, 1.45.5, 1.43.10.
- 6.1MediumSep 29, 2026Wikimedia Foundation Mediawiki - Wikibase Extension XSSCVE-2026-100245Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows Stored XSS. This issue affects Mediawiki - Wikibase Extension: from * before 1.46.1, 1.45.5, 1.43.10.
- 7.5HighSep 29, 2026Wikimedia Foundation Mediawiki - CentralAuth Extension Information disclosureCVE-2026-100244Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows Excavation. This issue affects Mediawiki - CentralAuth Extension: from * before 1.46.1, 1.45.5, 1.43.10.
- 6.1MediumSep 29, 2026Wikimedia Foundation Mediawiki - WikiSEO Extension XSSCVE-2026-100243Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - WikiSEO Extension allows Stored XSS. This issue affects Mediawiki - WikiSEO Extension: from * before 1.46.1, 1.45.5, 1.43.10.
- 7.5HighSep 29, 2026Wikimedia Foundation Mediawiki - DataTransfer Extension Denial of serviceCVE-2026-100242Dependency on Vulnerable Third-Party Component and Uncontrolled Resource Consumption vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows Excessive Allocation. This issue affects Mediawiki - DataTransfer Extension: from 1.46.0 before 1.47.0.
- 7.5HighSep 29, 2026Wikimedia Foundation Mediawiki - EventBus Extension Information disclosureCVE-2026-100241Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - EventBus Extension allows Excavation. This issue affects Mediawiki - EventBus Extension: 1.47.0-alpha.
- 9.1CriticalSep 29, 2026Wikimedia Foundation Mediawiki - TemplateSandbox Extension Auth bypass / access controlCVE-2026-100240Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - TemplateSandbox Extension: from * before 1.46.1, 1.45.5, 1.43.10.
- 6.1MediumSep 29, 2026Wikimedia Foundation Mediawiki - Flow Extension XSSCVE-2026-100238Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Flow Extension allows Stored XSS. This issue affects Mediawiki - Flow Extension: from * before 1.46.1, 1.45.5, 1.43.10.
- 4.8MediumSep 25, 2026Wikimedia Foundation Mediawiki - WikiLambda Extension XSSCVE-2026-100383Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has been remediated on the `master` branch.
- 10.0CriticalSep 25, 2026Wikimedia Foundation Mediawiki - ExternalData Extension Code / command injectionCVE-2026-100382Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Wikimedia Foundation Mediawiki - ExternalData Extension allows OS Command Injection. This issue affects Mediawiki - ExternalData Extension: from * before 3.7.
- 5.3MediumSep 25, 2026Wikimedia Foundation Mediawiki - UploadWizard Extension XSSCVE-2026-100381Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - UploadWizard Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - UploadWizard Extension: from * before 1.46.1, 1.45.5, 1.43.10.
- 5.3MediumSep 25, 2026Wikimedia Foundation Mediawiki - Wikibase Extension XSSCVE-2026-100380Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - Wikibase Extension: from * before 1.46.1, 1.45.5, 1.43.10.
- 5.3MediumSep 25, 2026Wikimedia Foundation Wikipedia Android App Information disclosureCVE-2026-100379Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Wikipedia Android App allows Accessing/Intercepting/Modifying HTTP Cookies. This issue affects Wikipedia Android App: main.
- 5.3MediumSep 25, 2026Wikimedia Foundation Mediawiki - Translate Extension Auth bypass / access controlCVE-2026-100378Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - Translate Extension allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - Translate Extension: from * before 1.46.1, 1.45.5, 1.43.10.
- 6.9MediumSep 25, 2026Wikimedia Foundation Mediawiki - WikiLambda Extension Information disclosureCVE-2026-100377Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Excavation. This issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has been remediated on the `master` branch.
- 4.8MediumSep 25, 2026Wikimedia Foundation Mediawiki - TemplateSandbox Extension XSSCVE-2026-100376Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - TemplateSandbox Extension: from * before 1.46.1, 1.45.5, 1.43.10.
Top products
- Mediawiki - WikiLambda Extension2 CVEs in the last year
- Mediawiki - Wikibase Extension2 CVEs in the last year
- Mediawiki - TemplateSandbox Extension2 CVEs in the last year, 1 critical
- Wikipedia Android App1 CVE in the last year
- Mediawiki - WikiSEO Extension1 CVE in the last year
- Mediawiki - UserPageViewTracker Extension1 CVE in the last year
- Mediawiki - UploadWizard Extension1 CVE in the last year
- Mediawiki - Translate Extension1 CVE in the last year
- Mediawiki - Flow Extension1 CVE in the last year
- Mediawiki - ExternalData Extension1 CVE in the last year, 1 critical
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.
