p PatchFirst

PatchFirst · Latest vulnerabilities

mediawiki vulnerabilities · Page 2

Vulnerabilities published for mediawiki in the last 30 days: 9. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 295

  1. CVE-2026-34095

    Low · CVSS 0EPSS 0.18%Fix available

    action=raw with Special:Mypage subpage title responds with "Content-Type: text/html" on ctype=text/javascript request

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Actions/ActionEntryPoint.Php, includes/Request/FauxResponse.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

    mediawikiOperating systems
    • Update to 1:1.43.8+dfsg-1~deb13u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  2. CVE-2026-34094

    Low · CVSS 2EPSS 0.17%Fix available

    Customized help link for page protection indicator is relative to subpage name, because the link target is missing the "/wiki/" prefix

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Page/Article.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

    mediawikiOperating systems
    • Update to 1:1.43.8+dfsg-1~deb13u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  3. CVE-2026-34093

    Low · CVSS 1.1EPSS 0.23%Fix available

    Special:UserRights allows viewing user rights from private wiki

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Specials/SpecialUserRights.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

    mediawikiOperating systems
    • Update to 1:1.43.8+dfsg-1~deb13u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  4. CVE-2026-34092

    Low · CVSS 2.1EPSS 0.24%Fix available

    Block UI elements in 'tools'-sidebar shows presence of an autoblocked IP

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Skin/Skin.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

    mediawikiOperating systems
    • Update to 1:1.43.8+dfsg-1~deb13u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  5. CVE-2026-34091

    Medium · CVSS 5.5EPSS 0.29%Fix available

    User localization leaked by AbuseFilter + EventStream

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

    mediawikiOperating systems
    • Update to 1:1.43.8+dfsg-1~deb13u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  6. CVE-2026-34088

    Low · CVSS 1.3EPSS 0.29%Fix available

    RecentChanges entries expose suppressed content via generated log page html

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

    mediawikiOperating systems
    • Update to 1:1.43.8+dfsg-1~deb13u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  7. CVE-2026-34087

    Medium · CVSS 5.1EPSS 0.27%Fix available

    Users API leaks whether privileged users have their user groups disabled for lack of 2FA

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation OATHAuth. This issue affects OATHAuth: from * before 1.43.7, 1.44.4, 1.45.2.

    mediawikiOperating systems
    • Update to 1:1.43.8+dfsg-1~deb13u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  9. CVE-2025-67481

    Low · CVSS 0EPSS 0.26%Fix available

    mw.message(…).parse() doesn't output safe HTML, but it's being used as if it does

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.JqueryMsg/mediawiki.JqueryMsg.Js. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

    mediawikiOperating systems
    • Update to 1:1.43.6+dfsg-1~deb13u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  10. CVE-2025-67482

    Low · CVSS 1.7EPSS 0.33%Fix available

    Lua segfault in unpack()

    Vulnerability in Wikimedia Foundation Scribunto, Wikimedia Foundation luasandbox. This vulnerability is associated with program files includes/Engines/LuaCommon/lualib/mwInit.Lua, library.C. This issue affects Scribunto: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1; luasandbox: from * before fea2304f8f6ab30314369a612f4f5b165e68e95a.

    mediawikiOperating systems
    • Update to 1:1.43.6+dfsg-1~deb13u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  11. CVE-2025-67483

    Low · CVSS 0EPSS 0.26%Fix available

    Theoretical i18n XSS in mediawiki.page.preview.js when a page has multiple protection levels

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Page.Preview.Js. This issue affects MediaWiki: from * before 1.43.6, 1.44.3, 1.45.1.

    mediawikiOperating systems
    • Update to 1:1.43.6+dfsg-1~deb13u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  12. CVE-2025-67484

    Low · CVSS 0EPSS 0.45%Fix available

    Action API xslt option allows JavaScript execution by administrators who are not interface administrators

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiFormatXml.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

    mediawikiOperating systems
    • Update to 1:1.43.6+dfsg-1~deb13u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  13. CVE-2025-67480

    Low · CVSS 0EPSS 0.25%Fix available

    list=allrevisions can be used to bypass Extension:Lockdown

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiQueryRevisionsBase.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

    mediawikiOperating systems
    • Update to 1:1.43.6+dfsg-1~deb13u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  14. CVE-2025-67475

    Low · CVSS 0EPSS 0.25%Fix available

    Stored XSS through edit summaries in MW Core

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/CommentFormatter/CommentParser.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

    mediawikiOperating systems
    • Update to 1:1.43.6+dfsg-1~deb13u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  15. CVE-2025-67477

    Low · CVSS 0EPSS 0.25%Fix available

    Stored XSS through a system message in Special:ApiSandbox

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandboxLayout.Js. This issue affects MediaWiki: from * before 1.44.3, 1.45.1.

    mediawikiOperating systems
    • Update to 1:1.43.6+dfsg-1~deb13u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  16. CVE-2025-67478

    Low · CVSS 0EPSS 0.35%Fix available

    Wrong E-Mail address composition for usernames with a comma and Umlauts in it like "Döe, Jähn"

    Vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files includes/Mail/UserMailer.Php. This issue affects CheckUser: from * before 1.39.14, 1.43.4, 1.44.1.

    mediawikiOperating systems
    • Update to 1:1.43.6+dfsg-1~deb13u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  17. CVE-2025-67479

    Low · CVSS 0EPSS 0.31%Fix available

    Magic word replacement in legacy parser allows using reserved data attributes through wikitext

    Vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Cite. This vulnerability is associated with program files includes/Parser/CoreParserFunctions.Php, includes/Parser/Sanitizer.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1; Cite: from * before 1.39.14, 1.43.4, 1.44.1.

    mediawikiOperating systems
    • Update to 1:1.43.6+dfsg-1~deb13u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  18. CVE-2025-61654

    Low · CVSS 0EPSS 0.36%Fix available

    UserInfoCard: Do permission checking when getting counts of global and local edits, new articles and thanks

    Vulnerability in Wikimedia Foundation Thanks. This vulnerability is associated with program files includes/ThanksQueryHelper.Php. This issue affects Thanks: from * before 1.43.4, 1.44.1.

    mediawikiOperating systems
    • Update to 1:1.43.6+dfsg-1~deb13u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  19. CVE-2025-61655

    Low · CVSS 0EPSS 0.17%Fix available

    Stored XSS through system messages in VisualEditor

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation VisualEditor. This vulnerability is associated with program files includes/ApiVisualEditorEdit.Php, modules/ve-mw/init/targets/ve.Init.Mw.DesktopArticleTarget.Js, modules/ve-mw/ui/dialogs/ve.Ui.MWSaveDialog.Js. This issue affects VisualEditor: from * before 1.39.14, 1.43.4, 1.44.1.

    mediawikiOperating systems
    • Update to 1:1.43.6+dfsg-1~deb13u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  20. CVE-2025-61656

    Low · CVSS 0EPSS 0.18%Fix available

    XSS when pasting into VE

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation VisualEditor. This vulnerability is associated with program files src/ce/ve.Ce.ClipboardHandler.Js. This issue affects VisualEditor: from * before 1.39.14, 1.43.4, 1.44.1.

    mediawikiOperating systems
    • Update to 1:1.43.6+dfsg-1~deb13u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →