CveMateVulnerability intelligence

The Wikimedia Foundation vulnerabilities, page 4

98 vulnerabilities

Known vulnerabilities in The Wikimedia Foundation products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 76 products.

CVE-2026-103046the wikimedia foundationmediawiki - wikilambda extension22d ago29-09-2026 22:41

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation MediaWiki - WikiLambda extension allows Stored XSS. This issue affects MediaWiki - WikiLambda extension: before 1.46.1.CVE-2026-103443the wikimedia foundationmediawiki collection (book) extension21d ago30-09-2026 16:19

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Collection (Book) extension allows XSS Targeting Non-Script Elements. This issue affects MediaWiki Collection (Book) extension: 1.46, 1.45, and 1.43.CVE-2026-103045ubuntumediawiki+122d ago29-09-2026 22:51

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Refreshed skin allows Stored XSS. This issue affects Mediawiki - Refreshed skin: before 1.46.1, 1.45.5, 1.43.10.CVE-2026-103437the wikimedia foundationmediawiki readinglists extension21d ago30-09-2026 17:17

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows Reflected XSS. This issue affects MediaWiki ReadingLists extension: 1.46 and 1.45.CVE-2026-103446the wikimedia foundationmediawiki wikilambda extension21d ago30-09-2026 17:13

Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass. This issue affects MediaWiki WikiLambda extension: 1.46.CVE-2026-103439the wikimedia foundationmediawiki wikbase extension21d ago30-09-2026 17:34

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikbase extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki Wikbase extension: 1.46, 1.45, and 1.43.CVE-2026-103047the wikimedia foundationmediawiki - centralauth extension22d ago29-09-2026 22:59

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth extension allows Stored XSS. This issue affects Mediawiki - CentralAuth extension: before 1.46.1, 1.45.5, 1.43.10.CVE-2026-103044ubuntumediawiki+122d ago29-09-2026 22:46

XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection. This issue affects Mediawiki - EasyTimeline extension: before 1.46.1, 1.45.5, 1.43.10.CVE-2026-103441the wikimedia foundationmediawiki wikibase extension21d ago30-09-2026 15:59

Deserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in Non-Executable Files. This issue affects MediaWiki Wikibase extension: 1.46, 1.45, and 1.43.CVE-2026-103050ubuntumediawiki+122d ago29-09-2026 23:11

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - MassMessage extension allows Stored XSS. This issue affects Mediawiki - MassMessage extension: before 1.46.1, 1.45.5, 1.43.10.CVE-2026-103049the wikimedia foundationmediawiki - cargo extension22d ago29-09-2026 23:08

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: before 1.46.1.CVE-2026-103438the wikimedia foundationmediawiki wikistories extension21d ago30-09-2026 17:32

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikistories extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki Wikistories extension: 1.46, 1.45, and 1.43.CVE-2026-103048ubuntumediawiki+122d ago29-09-2026 23:04

URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - Collection extension allows Fake the Source of Data. This issue affects Mediawiki - Collection extension: before 1.46.1, 1.45.5, 1.43.10.CVE-2026-103440the wikimedia foundationmediawiki pagetriage extension21d ago30-09-2026 17:38

Exposure of sensitive information through data queries vulnerability in The Wikimedia Foundation MediaWiki PageTriage extension allows Information Elicitation. This issue affects MediaWiki PageTriage extension: 1.46, 1.45, and 1.43.CVE-2026-103442the wikimedia foundationmediawiki centralauth extension21d ago30-09-2026 16:09

External control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection. This issue affects MediaWiki CentralAuth extension: 1.46, 1.45, and 1.43.CVE-2026-103585the wikimedia foundationmediawiki mediasearch extension21d ago30-09-2026 22:17

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki MediaSearch extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki MediaSearch extension: 1.46, 1.45, and 1.43.CVE-2026-103584the wikimedia foundationmediawiki commonsmetadata extension21d ago30-09-2026 22:14

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki CommonsMetadata extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki CommonsMetadata extension: 1.46, 1.45, and 1.43.CVE-2026-103051ubuntumediawiki+122d ago29-09-2026 23:13

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralNotice extension allows Stored XSS. This issue affects Mediawiki - CentralNotice extension: before 1.46.1, 1.45.5, 1.43.10.CVE-2026-103445the wikimedia foundationmediawiki page_forms extension21d ago30-09-2026 17:04

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Page_Forms extension allows Stored XSS. This issue affects MediaWiki Page_Forms extension: 1.46, 1.45, and 1.43.CVE-2026-58519mediawikicargo+13mo ago01-07-2026 03:59

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS. This issue affects Mediawiki - Cargo Extension: from * before 3.9.1.