p PatchFirst

PatchFirst · Latest vulnerabilities

mediawiki vulnerabilities · Page 2

Vulnerabilities published for mediawiki in the last 30 days: 16. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 191

  1. CVE-2026-58026

    Low · CVSS 0EPSS 0.37%No fix published

    $wgNonincludableNamespaces can be bypassed by embedding redirect in other namespaces

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Parser/Parser.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  2. CVE-2026-58027

    Medium · CVSS 5.3EPSS 0.37%No fix published

    QueryAbuseFilter API can be used to see the hit count of private filters, which is hidden in the UI

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program files includes/Api/QueryAbuseFilters.Php. This issue affects AbuseFilter: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  3. CVE-2026-58030

    Medium · CVSS 5.3EPSS 0.27%No fix published

    SyntaxHighlight stored XSS via unsanitized 'linelinks' attribute

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation SyntaxHighlight_GeSHi. This vulnerability is associated with program files includes/SyntaxHighlight.Php. This issue affects SyntaxHighlight_GeSHi: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  4. CVE-2026-58032

    Medium · CVSS 5.3EPSS 0.3%No fix published

    mw.Api.getErrorMessage() may return injected HTML if used without errorformat=html

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Api/index.Js. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  5. CVE-2026-58033

    Medium · CVSS 5.3EPSS 0.41%No fix published

    "Total number of distinct authors" statistic at action=info does not exclude revisions where the author name was deleted

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Actions/InfoAction.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  6. CVE-2026-58037

    Low · CVSS 0EPSS 0.27%No fix published

    Core log entries for exceptions and XSS issues in log entry formatting code that may be caused by user-controlled input

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Language/Language.Php, includes/Logging/BlockLogFormatter.Php, includes/Logging/LogFormatter.Php, includes/Logging/PatrolLogFormatter.Php, includes/Logging/RenameuserLogFormatter.Php, includes/Logging/TagLogFormatter.Php, includes/Specials/SpecialVersion.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  7. CVE-2026-58036

    Low · CVSS 2.1EPSS 0.32%No fix published

    Users API leaks whether privileged users have their user groups disabled for lack of 2FA

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiQueryAllUsers.Php, includes/Api/ApiQueryUsers.Php, includes/Permissions/PermissionManager.Php, includes/User/UserGroupManager.Php.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  8. CVE-2026-58024

    Medium · CVSS 5.1EPSS 0.37%No fix published

    API identification of users on private wikis

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiUserrights.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  9. CVE-2026-58031

    Low · CVSS 0EPSS 0.27%No fix published

    Stored i18n XSS in Special:ApiSandbox when a deprecated module is selected

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandboxLayout.Js. This issue affects MediaWiki: from 1.46.0-rc.0 before 1.46.0.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  10. CVE-2026-58035

    Low · CVSS 0EPSS 0.29%No fix published

    Stored XSS through a system message in the codex version of Special:Block

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Block/SpecialBlock.Vue.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  11. CVE-2026-5266

    Low · CVSS 2.3EPSS 0.25%No fix published

    CVE-2026-5266

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Echo. This vulnerability is associated with program files includes/Api/ApiEchoNotifications.Php. This issue affects Echo: from * before 1.43.7, 1.44.4, 1.45.2.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  12. CVE-2026-34095

    Low · CVSS 0EPSS 0.18%No fix published

    action=raw with Special:Mypage subpage title responds with "Content-Type: text/html" on ctype=text/javascript request

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Actions/ActionEntryPoint.Php, includes/Request/FauxResponse.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  13. CVE-2026-34094

    Low · CVSS 2EPSS 0.17%No fix published

    Customized help link for page protection indicator is relative to subpage name, because the link target is missing the "/wiki/" prefix

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Page/Article.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  14. CVE-2026-34093

    Low · CVSS 1.1EPSS 0.23%No fix published

    Special:UserRights allows viewing user rights from private wiki

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Specials/SpecialUserRights.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  17. CVE-2025-67481

    Low · CVSS 0EPSS 0.26%No fix published

    mw.message(…).parse() doesn't output safe HTML, but it's being used as if it does

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.JqueryMsg/mediawiki.JqueryMsg.Js. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  18. CVE-2025-67482

    Low · CVSS 1.7EPSS 0.33%No fix published

    Lua segfault in unpack()

    Vulnerability in Wikimedia Foundation Scribunto, Wikimedia Foundation luasandbox. This vulnerability is associated with program files includes/Engines/LuaCommon/lualib/mwInit.Lua, library.C. This issue affects Scribunto: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1; luasandbox: from * before fea2304f8f6ab30314369a612f4f5b165e68e95a.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  19. CVE-2025-67483

    Low · CVSS 0EPSS 0.26%No fix published

    Theoretical i18n XSS in mediawiki.page.preview.js when a page has multiple protection levels

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Page.Preview.Js. This issue affects MediaWiki: from * before 1.43.6, 1.44.3, 1.45.1.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  20. CVE-2025-67484

    Low · CVSS 0EPSS 0.45%No fix published

    Action API xslt option allows JavaScript execution by administrators who are not interface administrators

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiFormatXml.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →