CVE Program partner

wikimedia-foundation

The Wikimedia Foundation

API
CVEs, 365 days181245 all time, 0 rejected
Quality90%median 99%
CVSS by the CNA87%share of records
CWE83%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA12%lower is better
OrganisationThe Wikimedia Foundation
RoleCNA
TypeOpen Source
Reports tomitre
ScopeAny code repository hosted under <a href='https://gerrit.wikimedia.org' target='_blank'>gerrit.wikimedia.org</a>, <a href='https://gitlab.wikimedia.org' target='_blank'>gitlab.wikimedia.org</a>, or <a href='https://github.com/wikimedia' target='_blank'>github.com/wikimedia</a> that is not labeled as archived or marked as a fork of an upstream project. Please see our <a href='https://www.mediawiki.org/wiki/Reporting_security_bugs' target='_blank'>disclosure policy</a> for additional exclusions to scope.
Advisorieshttps://gitlab.wikimedia.org/repos/security/wikimedia-cve-assignments

Latest CVEs · RSS

  • CVE-2026-103585 2026-09-30 · CVSS 1.2
    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki MediaSearch extension allows C
  • CVE-2026-103584 2026-09-30 · CVSS 1.1
    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki CommonsMetadata extension allo
  • CVE-2026-103440 2026-09-30 · CVSS 1.2
    Exposure of sensitive information through data queries vulnerability in The Wikimedia Foundation MediaWiki PageTriage extension allows Information Elicitation.
  • CVE-2026-103439 2026-09-30 · CVSS 0.3
    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikbase extension allows Cross
  • CVE-2026-103438 2026-09-30 · CVSS 0.3
    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikistories extension allows C
  • CVE-2026-103437 2026-09-30 · CVSS 1.1
    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows
  • CVE-2026-103446 2026-09-30 · CVSS 7.4
    Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass. This is
  • CVE-2026-103445 2026-09-30 · CVSS 1.2
    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Page_Forms extension allows St
  • CVE-2026-103444 2026-09-30 · CVSS 1.1
    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki WikiForum extension allows Sto
  • CVE-2026-103443 2026-09-30 · CVSS 1.1
    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Collection (Book) extension al
  • CVE-2026-103442 2026-09-30 · CVSS 7.2
    External control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection. This issue
  • CVE-2026-103441 2026-09-30 · CVSS 7.2
    Deserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in Non-Executable Files
  • CVE-2026-103051 2026-09-29
    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralNotice extensi
  • CVE-2026-103050 2026-09-29
    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - MassMessage extension
  • CVE-2026-103049 2026-09-29
    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo extension allow
  • CVE-2026-103048 2026-09-29
    URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - Collection extension allows Fake the Source of Data.
  • CVE-2026-103047 2026-09-29
    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth extension
  • CVE-2026-103045 2026-09-29
    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Refreshed skin allows
  • CVE-2026-103044 2026-09-29
    XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection. This issue affects
  • CVE-2026-103046 2026-09-29
    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation MediaWiki - WikiLambda extension allo
  • CVE-2026-102796 2026-09-29
    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wikimedia Foundation Mediawiki - UserPageViewTracker Exten
  • CVE-2026-100245 2026-09-29
    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension
  • CVE-2026-100244 2026-09-29
    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows Excavation. This issu
  • CVE-2026-100243 2026-09-29
    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - WikiSEO Extension
  • CVE-2026-100242 2026-09-29
    Dependency on Vulnerable Third-Party Component and Uncontrolled Resource Consumption vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension al

All CVE Program partners