p PatchFirst

PatchFirst · Vulnerabilidades recientes

Vulnerabilidades de mediawiki

Vulnerabilidades publicadas para mediawiki en los últimos 30 días: 0. Incluidas en el catálogo KEV: 0.

RSS ↗ JSON ↗
Filtrar vulnerabilidades
Borrar filtros

Vulnerabilidades: 148

  1. CVE-2026-58025

    Media · CVSS 5.9EPSS 0,5%Sin corrección publicada

    Remote Code Execution via Unsafe Deserialization in LogItem Import

    Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/WikiImporter.Php, includes/Import/WikiRevision.Php, includes/Logging/LogEntryBase.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

    mediawikiSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  2. CVE-2026-58029

    Media · CVSS 5.3EPSS 0,35%Sin corrección publicada

    Full Account Takeover from BotPasswords and OAuth via action=changeauthenticationdata

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiChangeAuthenticationData.Php, includes/Api/ApiLinkAccount.Php, includes/Api/ApiRemoveAuthenticationData.Php, includes/Specials/SpecialLinkAccounts.Php, includes/Specials/SpecialUnlinkAccounts.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

    mediawikiSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  3. CVE-2026-58028

    Baja · CVSS 0EPSS 0,27%Sin corrección publicada

    Pretty-printed API output combined with centralauthtoken allows XSS with certain gadgets

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation CentralAuth. This vulnerability is associated with program files includes/Api/ApiFormatBase.Php, includes/Api/ApiHelp.Php, includes/ResourceLoader/Module.Php, includes/Hooks/Handlers/PageDisplayHookHandler.Php, includes/LogFormatter/PermissionChangeLogFormatter.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9; CentralAuth: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

    mediawikiSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  4. CVE-2026-58026

    Baja · CVSS 0EPSS 0,37%Sin corrección publicada

    $wgNonincludableNamespaces can be bypassed by embedding redirect in other namespaces

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Parser/Parser.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

    mediawikiSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  5. CVE-2026-58027

    Media · CVSS 5.3EPSS 0,37%Sin corrección publicada

    QueryAbuseFilter API can be used to see the hit count of private filters, which is hidden in the UI

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program files includes/Api/QueryAbuseFilters.Php. This issue affects AbuseFilter: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

    mediawikiSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  6. CVE-2026-58030

    Media · CVSS 5.3EPSS 0,27%Sin corrección publicada

    SyntaxHighlight stored XSS via unsanitized 'linelinks' attribute

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation SyntaxHighlight_GeSHi. This vulnerability is associated with program files includes/SyntaxHighlight.Php. This issue affects SyntaxHighlight_GeSHi: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

    mediawikiSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  7. CVE-2026-58032

    Media · CVSS 5.3EPSS 0,3%Sin corrección publicada

    mw.Api.getErrorMessage() may return injected HTML if used without errorformat=html

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Api/index.Js. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

    mediawikiSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  8. CVE-2026-58033

    Media · CVSS 5.3EPSS 0,41%Sin corrección publicada

    "Total number of distinct authors" statistic at action=info does not exclude revisions where the author name was deleted

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Actions/InfoAction.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

    mediawikiSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  9. CVE-2026-58037

    Baja · CVSS 0EPSS 0,27%Sin corrección publicada

    Core log entries for exceptions and XSS issues in log entry formatting code that may be caused by user-controlled input

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Language/Language.Php, includes/Logging/BlockLogFormatter.Php, includes/Logging/LogFormatter.Php, includes/Logging/PatrolLogFormatter.Php, includes/Logging/RenameuserLogFormatter.Php, includes/Logging/TagLogFormatter.Php, includes/Specials/SpecialVersion.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

    mediawikiSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  10. CVE-2026-58036

    Baja · CVSS 2.1EPSS 0,32%Sin corrección publicada

    Users API leaks whether privileged users have their user groups disabled for lack of 2FA

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiQueryAllUsers.Php, includes/Api/ApiQueryUsers.Php, includes/Permissions/PermissionManager.Php, includes/User/UserGroupManager.Php.

    mediawikiSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  11. CVE-2026-58024

    Media · CVSS 5.1EPSS 0,37%Sin corrección publicada

    API identification of users on private wikis

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiUserrights.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

    mediawikiSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  12. CVE-2026-58031

    Baja · CVSS 0EPSS 0,27%Sin corrección publicada

    Stored i18n XSS in Special:ApiSandbox when a deprecated module is selected

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandboxLayout.Js. This issue affects MediaWiki: from 1.46.0-rc.0 before 1.46.0.

    mediawikiSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  13. CVE-2026-58035

    Baja · CVSS 0EPSS 0,29%Sin corrección publicada

    Stored XSS through a system message in the codex version of Special:Block

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Block/SpecialBlock.Vue.

    mediawikiSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  14. CVE-2026-5266

    Baja · CVSS 2.3EPSS 0,25%Sin corrección publicada

    CVE-2026-5266

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Echo. This vulnerability is associated with program files includes/Api/ApiEchoNotifications.Php. This issue affects Echo: from * before 1.43.7, 1.44.4, 1.45.2.

    mediawikiSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  15. CVE-2026-34095

    Baja · CVSS 0EPSS 0,18%Sin corrección publicada

    action=raw with Special:Mypage subpage title responds with "Content-Type: text/html" on ctype=text/javascript request

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Actions/ActionEntryPoint.Php, includes/Request/FauxResponse.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

    mediawikiSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  16. CVE-2026-34094

    Baja · CVSS 2EPSS 0,17%Sin corrección publicada

    Customized help link for page protection indicator is relative to subpage name, because the link target is missing the "/wiki/" prefix

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Page/Article.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

    mediawikiSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  17. CVE-2026-34093

    Baja · CVSS 1.1EPSS 0,23%Sin corrección publicada

    Special:UserRights allows viewing user rights from private wiki

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Specials/SpecialUserRights.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

    mediawikiSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  18. CVE-2026-34092

    Baja · CVSS 2.1EPSS 0,24%Sin corrección publicada

    Block UI elements in 'tools'-sidebar shows presence of an autoblocked IP

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Skin/Skin.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

    mediawikiSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  19. CVE-2026-34091

    Media · CVSS 5.5EPSS 0,29%Sin corrección publicada

    User localization leaked by AbuseFilter + EventStream

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

    mediawikiSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

Comprueba tu servidor

Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.

Comprueba tu servidor →