Wikimedia Foundation vulnerabilities

CVEs per yearBy the year they were published

1. 20191
2. 20203
3. 202545
4. 2026103

Newest CVEs

• CVE-2026-102796

  Unauthenticated SQL injection in UserPageViewTracker via filterusers and ignoreusers parameters

  Wikimedia Foundation · Mediawiki - UserPageViewTracker Extension

  High7.5
• CVE-2026-100245

  Stored XSS on Wikibase Special:SetSiteLink via unescaped system message

  Wikimedia Foundation · Mediawiki - Wikibase Extension

  Medium6.1
• CVE-2026-100244

  CentralAuth exposes locally suppressed block information via globaluserinfo API and Special:CentralAuth (incomplete fix for CVE-2025-62669)

  Wikimedia Foundation · Mediawiki - CentralAuth Extension

  High7.5
• CVE-2026-100243

  Stored XSS in WikiSEO author and image properties on action=info

  Wikimedia Foundation · Mediawiki - WikiSEO Extension

  Medium6.1
• CVE-2026-100242

  DataTransfer depends on phpspreadsheet version vulnerable to CVE-2026-59933 (XLS/OLE memory exhaustion)

  Wikimedia Foundation · Mediawiki - DataTransfer Extension

  High7.5
• CVE-2026-100241

  Private change tags exposed to anonymous users via revision-tags-change events

  Wikimedia Foundation · Mediawiki - EventBus Extension

  High7.5
• CVE-2026-100240

  TemplateSandbox does not check read permissions for the page being previewed

  Wikimedia Foundation · Mediawiki - TemplateSandbox Extension

  Critical9.1
• CVE-2026-100238

  Flow colon-separator and flow-guidedtour-optin-welcome-description messages allow stored XSS

  Wikimedia Foundation · Mediawiki - Flow Extension

  Medium6.1
• CVE-2026-100383

  Stored i18n XSS in WikiLambda's VisualEditor integration

  Wikimedia Foundation · Mediawiki - WikiLambda Extension

  Medium4.8
• CVE-2026-100382

  Unauthenticated remote code execution through wikitext in ExternalData

  Wikimedia Foundation · Mediawiki - ExternalData Extension

  Critical10.0