Vulnerabilidades de The Wikimedia Foundation

🔔 Criar alerta RSS

CVEs publicadas que afetam produtos de The Wikimedia Foundation: 181 registro(s), com severidade, exploração e correções.

MediaWiki 45 Mediawiki - Cargo Extension 15 CheckUser 9 Mediawiki - WikiLambda Extension 7 Mediawiki - CentralAuth Extension 5 Mediawiki - Wikibase Extension 4 Mediawiki - GrowthExperiments Extension 4 MediaWiki - UploadWizard extension 3 AbuseFilter 3 Vector 2 Timeline 2 VisualEditor 2 Mediawiki - CirrusSearch Extension 2 MediaWiki PageForms extension 2 Scribunto 2 Mediawiki - PageTriage Extension 2 OATHAuth 2 Mediawiki - TemplateSandbox Extension 2 Mediawiki - CampaignEvents Extension 2 MediaWiki - ProofreadPage Extension 2 Mediawiki - Wikilove Extension 2 Mediawiki - Translate Extension 2 Mediawiki - Charts Extension 1 Mediawiki - UrlShortener Extension 1 Mediawiki - Thanks Extension 1 Mediawiki - UserPageViewTracker Extension 1 Wikipedia Android App 1 SyntaxHighlight GeSHi 1 CentralAuth 1 OAuth 1 UrlShortener 1 Mediawiki - RedirectManager Extension 1 MediaWiki CookieConsent extension 1 Mediawiki - Wikistories 1 Mediawiki - Skin:BlueSky 1 Mediawiki - Collection extension 1 MediaWiki MediaSearch extension 1 MediaWiki CommonsMetadata extension 1 MediaWiki Wikbase extension 1 MediaWiki Wikistories extension 1

Somente exploradas (KEV) →

CVE-2026-34091 Alta · 7.5 CWE-200 11/05/2026

User localization leaked by AbuseFilter + EventStream

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

CVE-2026-34090 Alta · 7.5 CWE-200 11/05/2026

Suggested investigations: Handle suppressed usernames

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation CheckUser. This issue affects CheckUser: from 1.45.0 before 1.45.2.

CVE-2026-34089 Alta · 7.5 CWE-401 11/05/2026

Memory leak in Scribunto causes runJobs.php to run out of memory

Vulnerability in Wikimedia Foundation Scribunto. This issue affects Scribunto: from 1.45.0 before 1.45.2.

CVE-2026-34088 Alta · 7.5 CWE-200 11/05/2026

RecentChanges entries expose suppressed content via generated log page html

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

CVE-2026-34087 Alta · 7.5 CWE-200 11/05/2026

Users API leaks whether privileged users have their user groups disabled for lack of 2FA

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation OATHAuth. This issue affects OATHAuth: from * before 1.43.7, 1.44.4, 1.45.2.

CVE-2026-34086 Baixa · 2.1 CWE-20 11/05/2026

AbuseFilter misuses ::userCanBitfield, exposing access-controlled information

Vulnerability in Wikimedia Foundation AbuseFilter. This issue affects AbuseFilter: from * before 1.43.7, 1.44.4, 1.45.2.

CVE-2026-39936 Média · 6.9 CWE-79 07/04/2026

Stored XSS in Score due to usage of non-reserved data attributes

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Score Extension allows Cross-Site Scripting (XSS). The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.

CVE-2026-39935 Média · 6.9 CWE-79 07/04/2026

XSS-via-i18n in localised wiki names

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CampaignEvents Extension allows Cross-Site Scripting (XSS). This issue was remediated only on the `master` branch.

CVE-2026-39937 Alta · 8.8 CWE-212 07/04/2026

Global vanishing does not completely remove user email

Improper removal of sensitive information before storage or transfer vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth Extension allows Resource Leak Exposure. The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.

CVE-2026-39934 Média · 6.9 CWE-835 07/04/2026

Growth Experiments ReassignMenteesJob runs as an infinite loop

Loop with unreachable exit condition ('infinite loop') vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions. This issue was remediated only on the `master` branch.

CVE-2026-39933 Média · 6.9 CWE-79 07/04/2026

Multiple XSS vulnerabilities in GlobalWatchlist

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - GlobalWatchlist Extension allows Cross-Site Scripting (XSS). The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.

CVE-2026-39841 Média · 6.1 CWE-79 07/04/2026

Stored XSS through list fields on Cargo's page values and Special:CargoTables

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7.

CVE-2026-39840 Média · 6.1 CWE-79 07/04/2026

CSS injection in multiple Cargo display formats

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows XSS Targeting Non-Script Elements.This issue affects Mediawiki - Cargo Extension: before 3.8.7.

CVE-2026-39839 Média · 6.1 CWE-80 07/04/2026

Stored XSS through URLs in Cargo's map format

CVE-2026-39838 Média · 6.9 CWE-79 07/04/2026

ProofreadPage improperly sanitizes multiline styles using Sanitizer::checkCSS

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation MediaWiki - ProofreadPage Extension allows XSS Targeting Non-Script Elements. The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.

CVE-2026-39837 Média · 5.4 CWE-80 07/04/2026

Stored XSS through the dynamic table format in Cargo

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in WikiWorks Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7.

CVE-2026-5762 Média · 5.3 CWE-770 07/04/2026

ReportIncident DiscussionTools integration causes slow requests

Allocation of resources without limits or throttling vulnerability in Wikimedia Foundation MediaWiki - ReportIncident Extension allows HTTP DoS. This issue was remediated only on the `master` branch.

CVE-2026-22711 Média · 6.9 CWE-87 07/04/2026

Stored XSS through system messages in WikiLove

Improper neutralization of alternate XSS syntax vulnerability in The Wikimedia Foundation Mediawiki - Wikilove Extension allows Cross-Site Scripting (XSS).The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.

CVE-2025-67484 Crítica · 9.8 CWE-20 02/02/2026

MediaWiki: falha de validação imprópria de entrada no formatador XML da API

Vulnerabilidade no Wikimedia Foundation MediaWiki. Esta vulnerabilidade está associada aos arquivos de programa includes/Api/ApiFormatXml.Php. Este problema afeta o MediaWiki: de * antes de 1.39.16, 1.43.6, 1.44.3, 1.45.1.

CVE-2025-67483 Média · 6.1 CWE-79 02/02/2026

Theoretical i18n XSS in mediawiki.page.preview.js when a page has multiple protection levels

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Page.Preview.Js. This issue affects MediaWiki: from * before 1.43.6, 1.44.3, 1.45.1.

CVE-2025-67482 Baixa · 1.7 02/02/2026

Lua segfault in unpack()

Vulnerability in Wikimedia Foundation Scribunto, Wikimedia Foundation luasandbox. This vulnerability is associated with program files includes/Engines/LuaCommon/lualib/mwInit.Lua, library.C. This issue affects Scribunto: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1; luasandbox: from * before fea2304f8f6ab30314369a612f4f5b165e68e95a.

CVE-2025-67481 Média · 6.1 CWE-79 02/02/2026

mw.message(…).parse() doesn't output safe HTML, but it's being used as if it does

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.JqueryMsg/mediawiki.JqueryMsg.Js. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

CVE-2025-67480 Média · 6.5 CWE-20 02/02/2026

list=allrevisions can be used to bypass Extension:Lockdown

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiQueryRevisionsBase.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

CVE-2025-67479 Nenhuma · 0.0 02/02/2026

Magic word replacement in legacy parser allows using reserved data attributes through wikitext

Vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Cite. This vulnerability is associated with program files includes/Parser/CoreParserFunctions.Php, includes/Parser/Sanitizer.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1; Cite: from * before 1.39.14, 1.43.4, 1.44.1.

CVE-2025-67478 Alta · 8.8 02/02/2026

Wrong E-Mail address composition for usernames with a comma and Umlauts in it like "Döe, Jähn"

Vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files includes/Mail/UserMailer.Php. This issue affects CheckUser: from * before 1.39.14, 1.43.4, 1.44.1.