Product by Wikimedia Foundation
Mediawiki
75 known vulnerabilities in Mediawiki (Wikimedia Foundation), 0 of them actively exploited (CISA KEV).
Key figures
75
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
2
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-8857 | Full RCE using EasyTimeline Extension | 8.8 | |
| High | CVE-2013-4572 | Wikimedia Foundation MediaWiki: security vulnerability | 7.5 | |
| Critical | CVE-2026-58025 | Remote Code Execution via Unsafe Deserialization in LogItem Import | 9.8 | |
| High | CVE-2026-13706 | Wikimedia Foundation UrlShortener: Improper Input Validation | 8.8 | |
| Medium | CVE-2013-4303 | Wikimedia Foundation MediaWiki: Cross-Site Scripting (XSS) | 6.1 | |
| Critical | CVE-2025-67484 | Wikimedia Foundation MediaWiki: security vulnerability | 9.8 | |
| High | CVE-2025-6926 | Security Authentication Bypass in CentralAuth | 8.8 | |
| Medium | CVE-2013-6451 | Wikimedia Foundation MediaWiki: Cross-Site Scripting (XSS) | 6.1 | |
| High | CVE-2025-67478 | Wrong E-Mail address composition for usernames with a comma and Umlauts in it like "Döe, Jähn" | 8.8 | |
| High | CVE-2026-13707 | Session fixation attacks on improperly configured OAuth 1.0a tools | 7.6 | |
| Medium | CVE-2026-58033 | Wikimedia Foundation MediaWiki: Exposure of Sensitive Information to an Unauthorized Actor | 6.5 | |
| High | CVE-2026-58036 | Users API leaks whether privileged users have their user groups disabled for lack of 2FA | 7.5 | |
| Medium | CVE-2013-6455 | Wikimedia Foundation MediaWiki: security vulnerability | 5.3 | |
| High | CVE-2026-34089 | Memory leak in Scribunto causes runJobs.php to run out of memory | 7.5 | |
| Medium | CVE-2026-58027 | QueryAbuseFilter API can be used to see the hit count of private filters, which is hidden in the UI | 6.5 | |
| Medium | CVE-2026-58029 | Full Account Takeover from BotPasswords and OAuth via action=changeauthenticationdata | 6.5 | |
| High | CVE-2026-34091 | User localization leaked by AbuseFilter + EventStream | 7.5 | |
| High | CVE-2026-34088 | RecentChanges entries expose suppressed content via generated log page html | 7.5 | |
| High | CVE-2026-34090 | Suggested investigations: Handle suppressed usernames | 7.5 | |
| High | CVE-2026-34087 | Users API leaks whether privileged users have their user groups disabled for lack of 2FA | 7.5 | |
| High | CVE-2026-34092 | Block UI elements in 'tools'-sidebar shows presence of an autoblocked IP | 7.5 | |
| Medium | CVE-2026-58026 | $wgNonincludableNamespaces can be bypassed by embedding redirect in other namespaces | 5.7 | |
| Medium | CVE-2026-58024 | API identification of users on private wikis | 5.7 | |
| Medium | CVE-2026-58032 | mw.Api.getErrorMessage() may return injected HTML if used without errorformat=html | 6.1 | |
| Medium | CVE-2026-58038 | Stored XSS through javascript URLs in SVGs generated by EasyTimeline | 6.1 |