Vendor
The Wikimedia Foundation
98 known vulnerabilities in products by The Wikimedia Foundation, 0 of them actively exploited (CISA KEV).
Key figures
98
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
5
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2024-47841 | Path traversal when loading stylesheets | 7.5 | |
| Critical | CVE-2026-103044 | EasyTimeline should not serve image maps as application/xml | 9.8 | |
| Medium | CVE-2025-62696 | Multiple critical security issues in Springboard | — | |
| Critical | CVE-2026-58521 | SQLi in Cargo extension via year range filter | 9.8 | |
| Critical | CVE-2026-14363 | Cargo Extension: SQLi in Special:Drilldown | 9.8 | |
| Critical | CVE-2024-47849 | Backticks can allow the usage of not-allowed SQL functions | 9.8 | |
| High | CVE-2026-103446 | WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments | — | |
| High | CVE-2025-11175 | DiscussionTools should use better regex | — | |
| Critical | CVE-2025-12004 | The compare API module breaks Extension:Lockdown | — | |
| Medium | CVE-2026-96878 | Cargo Exhibit field alias allows stored XSS | — | |
| Medium | CVE-2026-96877 | Reflected XSS through Cargo Drilldown full-text search | — | |
| Medium | CVE-2026-96876 | Anonymous reflected XSS in CargoExport invalid-alias errors | — | |
| Medium | CVE-2026-96875 | Reflected XSS in Cargo Drilldown hierarchy filters | — | |
| High | CVE-2026-103441 | Unauthenticated arbitrary file deletion through Wikibase serialized entity parsing | — | |
| High | CVE-2026-103442 | MergeAccount PHP object injection via session-key substitution | — | |
| Medium | CVE-2026-96879 | The Wikimedia Foundation Mediawiki - FlaggedRevs extension: Improper Removal of Sensitive Information Before Storage or Transfer | — | |
| High | CVE-2026-39937 | Global vanishing does not completely remove user email | — | |
| Medium | CVE-2026-96873 | Reflected XSS in CirrusSearch debug explain output | — | |
| High | CVE-2025-62697 | Improperly sanitized style parameter in LanguageSelector | — | |
| Medium | CVE-2025-62670 | Stored XSS through a system message in FlexDiagrams | — | |
| Medium | CVE-2025-62671 | Stored XSS through wikitext in Cargo | — | |
| Medium | CVE-2025-62662 | Stored XSS through system messages in AdvancedSearch | — | |
| Medium | CVE-2025-62663 | Stored XSS through a system message in UploadWizard | — | |
| Medium | CVE-2026-103051 | Stored i18n XSSs in CentralNotice | 6.1 | |
| Medium | CVE-2026-103050 | Stored i18n XSS in MassMessage | 6.1 |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 26sans-atrisk-mail,
Products
| Mediawiki - Cargo Extension | 11 | 0 |
| Mediawiki - Wikilambda Extension | 5 | 0 |
| Mediawiki - Centralauth Extension | 4 | 0 |
| Mediawiki - Growthexperiments Extension | 4 | 0 |
| Mediawiki - Cargo | 3 | 0 |