Wikimedia Foundation Mediawiki vulnerabilities
55 known vulnerabilities affecting wikimedia_foundation/mediawiki.
Total CVEs
55
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL2HIGH5MEDIUM33LOW8
Vulnerabilities
Page 1 of 3
CVE-2026-58025P3CRITICALCVSS 9.8≥ *, < 1.46.0, 1.45.4, 1.44.6, 1.43.92026-07-01
CVE-2026-58025 [CRITICAL] CWE-94 CVE-2026-58025: Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerabil
Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki.
This vulnerability is associated with program files includes/Import/WikiImporter.Php, includes/Import/WikiRevision.Php, includes/Logging/LogEntryBase.Php.
This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.
nvd
CVE-2025-67484P3CRITICALCVSS 9.8≥ *, < 1.39.16, 1.43.6, 1.44.3, 1.45.12026-02-03
CVE-2025-67484 [CRITICAL] CWE-20 CVE-2025-67484: Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiFormatXml.Php.
This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.
nvd
CVE-2026-58036P3HIGHCVSS 7.5≥ 1.46.0-rc.0, < 1.46.02026-07-01
CVE-2026-58036 [HIGH] CWE-200 CVE-2026-58036: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Med
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.
This vulnerability is associated with program files includes/Api/ApiQueryAllUsers.Php, includes/Api/ApiQueryUsers.Php, includes/Permissions/PermissionManager.Php, includes/User/UserGroupManager.Php.
nvd
CVE-2013-4572P3HIGHCVSS 7.5vbefore 1.19.9v1.20.x before 1.20.8+1 more2020-02-06
CVE-2013-4572 [HIGH] CWE-384 CVE-2013-4572: The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.2
The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cache session cookies when a user is autocreated, which allows remote attackers to authenticate as the created user.
nvd
CVE-2026-34092P3HIGHCVSS 7.5≥ *, < 1.43.7, 1.44.4, 1.45.22026-05-11
CVE-2026-34092 [HIGH] CWE-200 CVE-2026-34092: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Med
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.
This vulnerability is associated with program files includes/Skin/Skin.Php.
This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.
nvd
CVE-2026-34091P3HIGHCVSS 7.5≥ *, < 1.43.7, 1.44.4, 1.45.22026-05-11
CVE-2026-34091 [HIGH] CWE-200 CVE-2026-34091: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Med
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.
This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.
nvd
CVE-2026-34088P3HIGHCVSS 7.5≥ *, < 1.43.7, 1.44.4, 1.45.22026-05-11
CVE-2026-34088 [HIGH] CWE-200 CVE-2026-34088: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Med
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.
This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.
nvd
CVE-2025-67480P3MEDIUMCVSS 6.5≥ *, < 1.39.16, 1.43.6, 1.44.3, 1.45.12026-02-03
CVE-2025-67480 [MEDIUM] CWE-20 CVE-2025-67480: Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiQueryRevisionsBase.Php.
This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.
nvd
CVE-2026-58029P3MEDIUMCVSS 6.5≥ *, < 1.46.0, 1.45.4, 1.44.6, 1.43.92026-07-01
CVE-2026-58029 [MEDIUM] CWE-287 CVE-2026-58029: Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program fil
Vulnerability in Wikimedia Foundation MediaWiki.
This vulnerability is associated with program files includes/Api/ApiChangeAuthenticationData.Php, includes/Api/ApiLinkAccount.Php, includes/Api/ApiRemoveAuthenticationData.Php, includes/Specials/SpecialLinkAccounts.Php, includes/Specials/SpecialUnlinkAccounts.Php.
This issue affects MediaWiki: from *
nvd
CVE-2026-58033P4MEDIUMCVSS 6.5≥ *, < 1.46.0, 1.45.4, 1.44.6, 1.43.92026-07-01
CVE-2026-58033 [MEDIUM] CWE-200 CVE-2026-58033: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Med
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.
This vulnerability is associated with program files includes/Actions/InfoAction.Php.
This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.
nvd
CVE-2025-61641P4MEDIUMCVSS 6.1≥ *, < 1.39.14, 1.43.4, 1.44.12026-02-03
CVE-2025-61641 [MEDIUM] CWE-22 CVE-2025-61641: Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/api/ApiQueryAllPages.Php.
This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.
nvd
CVE-2026-58024P4MEDIUMCVSS 5.7≥ *, < 1.46.0, 1.45.4, 1.44.6, 1.43.92026-07-01
CVE-2026-58024 [MEDIUM] CWE-200 CVE-2026-58024: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Med
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.
This vulnerability is associated with program files includes/Api/ApiUserrights.Php.
This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.
nvd
CVE-2013-4303P4MEDIUMCVSS 6.1v1.19.x before 1.19.8v1.20.x before 1.20.7+1 more2019-12-11
CVE-2013-4303 [MEDIUM] CWE-79 CVE-2013-4303: includes/libs/IEUrlExtension.php in the MediaWiki API in MediaWiki 1.19.x before 1.19.8, 1.20.x befo
includes/libs/IEUrlExtension.php in the MediaWiki API in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 does not properly detect extensions when there are an even number of "." (period) characters in a string, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the siprop parameter in a query
nvd
CVE-2026-34095P4MEDIUMCVSS 6.1≥ *, < 1.43.7, 1.44.4, 1.45.22026-05-11
CVE-2026-34095 [MEDIUM] CWE-668 CVE-2026-34095: Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program fil
Vulnerability in Wikimedia Foundation MediaWiki.
This vulnerability is associated with program files includes/Actions/ActionEntryPoint.Php, includes/Request/FauxResponse.Php.
This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.
nvd
CVE-2026-58026P4MEDIUMCVSS 5.7≥ *, < 1.46.0, 1.45.4, 1.44.6, 1.43.92026-07-01
CVE-2026-58026 [MEDIUM] CWE-200 CVE-2026-58026: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Med
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.
This vulnerability is associated with program files includes/Parser/Parser.Php.
This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.
nvd
CVE-2025-61643P4MEDIUMCVSS 6.1≥ *, < 1.39.14, 1.43.4, 1.44.12026-02-03
CVE-2025-61643 [MEDIUM] CWE-212 CVE-2025-61643: Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/recentchanges/RecentChangeRCFeedNotifier.Php.
This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.
nvd
CVE-2025-61646P4MEDIUMCVSS 5.4≥ *, < 1.39.14, 1.43.4, 1.44.12026-02-03
CVE-2025-61646 [MEDIUM] CWE-22 CVE-2025-61646: Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/RecentChanges/EnhancedChangesList.Php.
This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.
nvd
CVE-2026-58028P4MEDIUMCVSS 5.4≥ *, < 1.46.0, 1.45.4, 1.44.6, 1.43.92026-07-01
CVE-2026-58028 [MEDIUM] CWE-79 CVE-2026-58028: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation CentralAuth.
This vulnerability is associated with program files includes/Api/ApiFormatBase.Php, includes/Api/ApiHelp.Php, includes/ResourceLoader/Module.Php, includes/Hooks/Handlers/PageDi
nvd
CVE-2026-34093P4MEDIUMCVSS 5.3≥ *, < 1.43.7, 1.44.4, 1.45.22026-05-11
CVE-2026-34093 [MEDIUM] CWE-200 CVE-2026-34093: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Med
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.
This vulnerability is associated with program files includes/Specials/SpecialUserRights.Php.
This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.
nvd
CVE-2025-61642P4MEDIUMCVSS 6.1≥ *, < 1.39.14, 1.43.4, 1.44.12026-02-03
CVE-2025-61642 [MEDIUM] CWE-79 CVE-2025-61642: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/CodexHTMLForm.Php, includes/htmlform/fields/HTMLButtonField.Php.
This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.
nvd
1 / 3Next →