p PatchFirst

PatchFirst · Vulnérabilités récentes

Vulnérabilités de mediawiki · Page n° 2

Vulnérabilités publiées pour mediawiki au cours des 30 derniers jours : 16. Présentes dans le catalogue KEV : 0.

RSS ↗ JSON ↗
Filtrer les vulnérabilités
Effacer les filtres

Vulnérabilités : 191

  1. CVE-2026-58026

    Faible · CVSS 0EPSS 0,37%Aucun correctif publié

    $wgNonincludableNamespaces can be bypassed by embedding redirect in other namespaces

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Parser/Parser.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  2. CVE-2026-58027

    Moyenne · CVSS 5.3EPSS 0,37%Aucun correctif publié

    QueryAbuseFilter API can be used to see the hit count of private filters, which is hidden in the UI

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program files includes/Api/QueryAbuseFilters.Php. This issue affects AbuseFilter: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  3. CVE-2026-58030

    Moyenne · CVSS 5.3EPSS 0,27%Aucun correctif publié

    SyntaxHighlight stored XSS via unsanitized 'linelinks' attribute

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation SyntaxHighlight_GeSHi. This vulnerability is associated with program files includes/SyntaxHighlight.Php. This issue affects SyntaxHighlight_GeSHi: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  4. CVE-2026-58032

    Moyenne · CVSS 5.3EPSS 0,3%Aucun correctif publié

    mw.Api.getErrorMessage() may return injected HTML if used without errorformat=html

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Api/index.Js. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  5. CVE-2026-58033

    Moyenne · CVSS 5.3EPSS 0,41%Aucun correctif publié

    "Total number of distinct authors" statistic at action=info does not exclude revisions where the author name was deleted

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Actions/InfoAction.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  6. CVE-2026-58037

    Faible · CVSS 0EPSS 0,27%Aucun correctif publié

    Core log entries for exceptions and XSS issues in log entry formatting code that may be caused by user-controlled input

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Language/Language.Php, includes/Logging/BlockLogFormatter.Php, includes/Logging/LogFormatter.Php, includes/Logging/PatrolLogFormatter.Php, includes/Logging/RenameuserLogFormatter.Php, includes/Logging/TagLogFormatter.Php, includes/Specials/SpecialVersion.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  7. CVE-2026-58036

    Faible · CVSS 2.1EPSS 0,32%Aucun correctif publié

    Users API leaks whether privileged users have their user groups disabled for lack of 2FA

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiQueryAllUsers.Php, includes/Api/ApiQueryUsers.Php, includes/Permissions/PermissionManager.Php, includes/User/UserGroupManager.Php.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  8. CVE-2026-58024

    Moyenne · CVSS 5.1EPSS 0,37%Aucun correctif publié

    API identification of users on private wikis

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiUserrights.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  9. CVE-2026-58031

    Faible · CVSS 0EPSS 0,27%Aucun correctif publié

    Stored i18n XSS in Special:ApiSandbox when a deprecated module is selected

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandboxLayout.Js. This issue affects MediaWiki: from 1.46.0-rc.0 before 1.46.0.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  10. CVE-2026-58035

    Faible · CVSS 0EPSS 0,29%Aucun correctif publié

    Stored XSS through a system message in the codex version of Special:Block

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Block/SpecialBlock.Vue.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  11. CVE-2026-5266

    Faible · CVSS 2.3EPSS 0,25%Aucun correctif publié

    CVE-2026-5266

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Echo. This vulnerability is associated with program files includes/Api/ApiEchoNotifications.Php. This issue affects Echo: from * before 1.43.7, 1.44.4, 1.45.2.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  12. CVE-2026-34095

    Faible · CVSS 0EPSS 0,18%Aucun correctif publié

    action=raw with Special:Mypage subpage title responds with "Content-Type: text/html" on ctype=text/javascript request

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Actions/ActionEntryPoint.Php, includes/Request/FauxResponse.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  13. CVE-2026-34094

    Faible · CVSS 2EPSS 0,17%Aucun correctif publié

    Customized help link for page protection indicator is relative to subpage name, because the link target is missing the "/wiki/" prefix

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Page/Article.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  14. CVE-2026-34093

    Faible · CVSS 1.1EPSS 0,23%Aucun correctif publié

    Special:UserRights allows viewing user rights from private wiki

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Specials/SpecialUserRights.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  17. CVE-2025-67481

    Faible · CVSS 0EPSS 0,26%Aucun correctif publié

    mw.message(…).parse() doesn't output safe HTML, but it's being used as if it does

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.JqueryMsg/mediawiki.JqueryMsg.Js. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  18. CVE-2025-67482

    Faible · CVSS 1.7EPSS 0,33%Aucun correctif publié

    Lua segfault in unpack()

    Vulnerability in Wikimedia Foundation Scribunto, Wikimedia Foundation luasandbox. This vulnerability is associated with program files includes/Engines/LuaCommon/lualib/mwInit.Lua, library.C. This issue affects Scribunto: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1; luasandbox: from * before fea2304f8f6ab30314369a612f4f5b165e68e95a.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  19. CVE-2025-67483

    Faible · CVSS 0EPSS 0,26%Aucun correctif publié

    Theoretical i18n XSS in mediawiki.page.preview.js when a page has multiple protection levels

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Page.Preview.Js. This issue affects MediaWiki: from * before 1.43.6, 1.44.3, 1.45.1.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  20. CVE-2025-67484

    Faible · CVSS 0EPSS 0,45%Aucun correctif publié

    Action API xslt option allows JavaScript execution by administrators who are not interface administrators

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiFormatXml.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

Vérifiez votre serveur

Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.

Vérifiez votre serveur →