Wikimedia Foundation MediaWiki vulnerabilities

CVEs per yearBy the year they were published

1. 20191
2. 20203
3. 20256
4. 202645

Newest CVEs

• CVE-2026-58025

  Remote Code Execution via Unsafe Deserialization in LogItem Import

  Wikimedia Foundation · MediaWiki

  Medium5.9
• CVE-2026-58029

  Full Account Takeover from BotPasswords and OAuth via action=changeauthenticationdata

  Wikimedia Foundation · MediaWiki

  Medium5.3
• CVE-2026-58028

  Pretty-printed API output combined with centralauthtoken allows XSS with certain gadgets

  Wikimedia Foundation · MediaWiki

  None0.0
• CVE-2026-58026

  $wgNonincludableNamespaces can be bypassed by embedding redirect in other namespaces

  Wikimedia Foundation · MediaWiki

  None0.0
• CVE-2026-58032

  mw.Api.getErrorMessage() may return injected HTML if used without errorformat=html

  Wikimedia Foundation · MediaWiki

  Medium5.3
• CVE-2026-58033

  "Total number of distinct authors" statistic at action=info does not exclude revisions where the author name was deleted

  Wikimedia Foundation · MediaWiki

  Medium5.3
• CVE-2026-58037

  Core log entries for exceptions and XSS issues in log entry formatting code that may be caused by user-controlled input

  Wikimedia Foundation · MediaWiki

  None0.0
• CVE-2026-58036

  Users API leaks whether privileged users have their user groups disabled for lack of 2FA

  Wikimedia Foundation · MediaWiki

  Low2.1
• CVE-2026-58024

  API identification of users on private wikis

  Wikimedia Foundation · MediaWiki

  Medium5.1
• CVE-2026-58031

  Stored i18n XSS in Special:ApiSandbox when a deprecated module is selected

  Wikimedia Foundation · MediaWiki

  None0.0