Vulnerabilidades de The Wikimedia Foundation

🔔 Criar alerta RSS

CVEs publicadas que afetam produtos de The Wikimedia Foundation: 181 registro(s), com severidade, exploração e correções.

MediaWiki 45 Mediawiki - Cargo Extension 15 CheckUser 9 Mediawiki - WikiLambda Extension 7 Mediawiki - CentralAuth Extension 5 Mediawiki - Wikibase Extension 4 Mediawiki - GrowthExperiments Extension 4 MediaWiki - UploadWizard extension 3 AbuseFilter 3 Vector 2 Timeline 2 VisualEditor 2 Mediawiki - CirrusSearch Extension 2 MediaWiki PageForms extension 2 Scribunto 2 Mediawiki - PageTriage Extension 2 OATHAuth 2 Mediawiki - TemplateSandbox Extension 2 Mediawiki - CampaignEvents Extension 2 MediaWiki - ProofreadPage Extension 2 Mediawiki - Wikilove Extension 2 Mediawiki - Translate Extension 2 Mediawiki - Charts Extension 1 Mediawiki - UrlShortener Extension 1 Mediawiki - Thanks Extension 1 Mediawiki - UserPageViewTracker Extension 1 Wikipedia Android App 1 SyntaxHighlight GeSHi 1 CentralAuth 1 OAuth 1 UrlShortener 1 Mediawiki - RedirectManager Extension 1 MediaWiki CookieConsent extension 1 Mediawiki - Wikistories 1 Mediawiki - Skin:BlueSky 1 Mediawiki - Collection extension 1 MediaWiki MediaSearch extension 1 MediaWiki CommonsMetadata extension 1 MediaWiki Wikbase extension 1 MediaWiki Wikistories extension 1

Somente exploradas (KEV) →

CVE-2026-100241 Alta · 7.5 CWE-200 29/09/2026

Private change tags exposed to anonymous users via revision-tags-change events

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - EventBus Extension allows Excavation. This issue affects Mediawiki - EventBus Extension: 1.47.0-alpha.

CVE-2026-100240 Crítica · 9.1 CWE-862 29/09/2026

TemplateSandbox does not check read permissions for the page being previewed

Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - TemplateSandbox Extension: from * before 1.46.1, 1.45.5, 1.43.10.

CVE-2026-100238 Média · 6.1 CWE-79 29/09/2026

Flow colon-separator and flow-guidedtour-optin-welcome-description messages allow stored XSS

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Flow Extension allows Stored XSS. This issue affects Mediawiki - Flow Extension: from * before 1.46.1, 1.45.5, 1.43.10.

CVE-2026-100383 Média · 4.8 CWE-79 25/09/2026

Stored i18n XSS in WikiLambda's VisualEditor integration

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has been remediated on the `master` branch.

CVE-2026-100382 Crítica · 10.0 CWE-78 25/09/2026

Unauthenticated remote code execution through wikitext in ExternalData

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Wikimedia Foundation Mediawiki - ExternalData Extension allows OS Command Injection. This issue affects Mediawiki - ExternalData Extension: from * before 3.7.

CVE-2026-100381 Média · 5.3 CWE-79 25/09/2026

UploadWizard Flickr collection and set titles allow DOM XSS

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - UploadWizard Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - UploadWizard Extension: from * before 1.46.1, 1.45.5, 1.43.10.

CVE-2026-96879 Média · 6.9 CWE-212 25/09/2026

"Checked by" label in page history should not be shown if the underlying review log entry is suppressed"

Improper removal of sensitive information before storage or transfer vulnerability in Wikimedia Foundation's Mediawiki - FlaggedRevs extension through 1.46.0.

CVE-2026-100380 Média · 5.3 CWE-79 25/09/2026

Reflected XSS in Wikibase Special:SetLabel language validation

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - Wikibase Extension: from * before 1.46.1, 1.45.5, 1.43.10.

CVE-2026-100379 Média · 5.3 CWE-200 25/09/2026

Cross-request disclosure of CentralAuth cookies in Wikipedia Android App

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Wikipedia Android App allows Accessing/Intercepting/Modifying HTTP Cookies. This issue affects Wikipedia Android App: main.

CVE-2026-100378 Média · 5.3 CWE-862 25/09/2026

Missing permission check in the Translate sandbox doRemind action

Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - Translate Extension allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - Translate Extension: from * before 1.46.1, 1.45.5, 1.43.10.

CVE-2026-100377 Média · 6.9 CWE-200 25/09/2026

Revision-deleted pages can be viewed through WikiLambda's action=edit and Special:ViewAbstract

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Excavation. This issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has been remediated on the `master` branch.

CVE-2026-100376 Média · 4.8 CWE-79 25/09/2026

TemplateSandbox can be abused for XSS by asking another user to preview a page with a certain sandbox prefix

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - TemplateSandbox Extension: from * before 1.46.1, 1.45.5, 1.43.10.

CVE-2026-96878 Média · 6.9 CWE-79 25/09/2026

Cargo Exhibit field alias allows stored XSS

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

CVE-2026-96877 Média · 6.9 CWE-79 25/09/2026

Reflected XSS through Cargo Drilldown full-text search

CVE-2026-96876 Média · 6.9 CWE-79 25/09/2026

Anonymous reflected XSS in CargoExport invalid-alias errors

CVE-2026-96875 Média · 6.9 CWE-79 25/09/2026

Reflected XSS in Cargo Drilldown hierarchy filters

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

CVE-2026-100237 Média · 6.1 CWE-79 25/09/2026

Stored i18n XSS in the Flow integration of Thanks

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Thanks Extension allows Stored XSS. This issue affects Mediawiki - Thanks Extension: from * before 1.43.10/1.45.5/1.46.1.

CVE-2026-96874 Baixa · 2.3 CWE-79 25/09/2026

Stored XSS in Cargo Drilldown tab names

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in the Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

CVE-2026-96873 Média · 5.5 CWE-79 24/09/2026

Reflected XSS in CirrusSearch debug explain output

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - CirrusSearch extension allows Reflected XSS. This issue affects Mediawiki - CirrusSearch extension through 1.46.0.

CVE-2026-96872 Baixa · 2.9 CWE-280 23/09/2026

WikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositions

Improper handling of insufficient permissions or privileges vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension on Linux, MacOS, and Windows allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - WikiLambda Extension: before 1.47.0.

CVE-2026-14363 Crítica · 9.8 CWE-89 01/07/2026

Cargo Extension: SQLi in Special:Drilldown

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4.

CVE-2026-58517 Média · 4.3 CWE-288 01/07/2026

Blocked users can create and edit WikiLambda objects

Improper neutralization of input terminators vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Authentication Bypass. This issue affects Mediawiki - WikiLambda Extension: from * before 1.43.9,1.44.6,1.45.4.

CVE-2026-14358 Média · 6.1 CWE-79 01/07/2026

Stored XSS in Wikimedia Chart pie tooltip via Data:*.tab field title

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Charts Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - Charts Extension: from * before 1.43.9,1.44.6,1.45.4.

CVE-2026-58521 Crítica · 9.8 CWE-89 01/07/2026

SQLi in Cargo extension via year range filter

CVE-2026-58520 Média · 6.1 CWE-601 01/07/2026

UrlShortener defaults to ineffective validation open to third-party redirects

URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - UrlShortener Extension allows Cross-Site Flashing. This issue affects Mediawiki - UrlShortener Extension: from * before 1.43.9, 1.44.6, 1.45.4.