Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

Wikimedia Foundation — Vulnerabilities & Security Advisories 152

Browse all 152 CVE security advisories affecting Wikimedia Foundation. AI-powered Chinese analysis, POCs, and references for each vulnerability.

The Wikimedia Foundation operates the world’s largest collaborative encyclopedia platform, hosting Wikipedia and related projects that serve billions of monthly visitors. Its infrastructure relies on complex software stacks, including MediaWiki, which has historically been susceptible to various vulnerability classes. Common issues include cross-site scripting (XSS), SQL injection, and remote code execution (RCE) stemming from legacy code paths or misconfigurations. While the organization maintains a robust security posture with regular audits and bug bounty programs, the sheer scale of its codebase and the open nature of its editing model present unique challenges. Recent years have seen efforts to mitigate privilege escalation risks and improve input validation. Despite these ongoing technical hurdles, the Foundation remains a critical public resource, balancing transparency with the need to protect user data and system integrity against sophisticated cyber threats targeting its extensive digital footprint.

Top products by Wikimedia Foundation: MediaWiki CheckUser Mediawiki - Cargo Extension Mediawiki - AbuseFilter Extension Mediawiki - CheckUser extension Mediawiki - SecurePoll extension AbuseFilter Mediawiki - TemplateSandbox Extension VisualEditor Scribunto timeline OATHAuth Mediawiki - MintyDocs Extension Mediawiki - CampaignEvents Extension Mediawiki - WikiLambda Extension Vector Mediawiki - Wikibase Extension Mediawiki - IPInfo Extension MediaWiki - ProofreadPage Extension MediaWiki - UploadWizard extension Mediawiki - CentralAuth Extension Mediawiki - DataTransfer Extension Wikipedia Android App Mediawiki - EventBus Extension SyntaxHighlight_GeSHi Mediawiki - Flow Extension Thanks TextExtracts DiscussionTools ConfirmEdit
CVE ID Title CVSS Severity Published
CVE-2026-13706 UrlShortener extension url validation can be bypassed due to difference between php url parsing and WHATWG — UrlShortener CWE-20 - - 2026-07-01
CVE-2026-58031 Stored i18n XSS in Special:ApiSandbox when a deprecated module is selected — MediaWiki CWE-79 - - 2026-07-01
CVE-2026-58034 Stored XSS through a system message when blocking a temporary account that's related to other temporary accounts — CheckUser CWE-79 - - 2026-07-01
CVE-2026-58035 Stored XSS through a system message in the codex version of Special:Block — MediaWiki CWE-79 - - 2026-07-01
CVE-2026-5266 Wikimedia Echo 信息泄露漏洞 — Echo CWE-200 - - 2026-05-11
CVE-2026-34095 action=raw with Special:Mypage subpage title responds with "Content-Type: text/html" on ctype=text/javascript request — MediaWiki - - 2026-05-11
CVE-2026-34094 Customized help link for page protection indicator is relative to subpage name, because the link target is missing the "/wiki/" prefix — MediaWiki - - 2026-05-11
CVE-2026-34093 Special:UserRights allows viewing user rights from private wiki — MediaWiki CWE-200 - - 2026-05-11
CVE-2026-34092 Block UI elements in 'tools'-sidebar shows presence of an autoblocked IP — MediaWiki CWE-200 - - 2026-05-11
CVE-2026-34091 User localization leaked by AbuseFilter + EventStream — MediaWiki CWE-200 - - 2026-05-11
CVE-2026-34090 Suggested investigations: Handle suppressed usernames — CheckUser CWE-200 - - 2026-05-11
CVE-2026-34089 Memory leak in Scribunto causes runJobs.php to run out of memory — Scribunto - - 2026-05-11
CVE-2026-34088 RecentChanges entries expose suppressed content via generated log page html — MediaWiki CWE-200 - - 2026-05-11
CVE-2026-34087 Users API leaks whether privileged users have their user groups disabled for lack of 2FA — OATHAuth CWE-200 - - 2026-05-11
CVE-2026-34086 AbuseFilter misuses ::userCanBitfield, exposing access-controlled information — AbuseFilter - - 2026-05-11
CVE-2026-39837 Stored XSS through the dynamic table format in Cargo — Mediawiki - Cargo Extension CWE-80 6.1AI Medium AI 2026-04-07
CVE-2026-39841 Stored XSS through list fields on Cargo's page values and Special:CargoTables — Mediawiki - Cargo Extension CWE-80 6.1AI Medium AI 2026-04-07
CVE-2026-39840 CSS injection in multiple Cargo display formats — Mediawiki - Cargo Extension CWE-79 6.1AI Medium AI 2026-04-07
CVE-2026-39839 Stored XSS through URLs in Cargo's map format — Mediawiki - Cargo Extension CWE-80 6.1AI Medium AI 2026-04-07
CVE-2026-39838 ProofreadPage improperly sanitizes multiline styles using Sanitizer::checkCSS — MediaWiki - ProofreadPage Extension CWE-79 6.1AI Medium AI 2026-04-07
CVE-2026-5762 ReportIncident DiscussionTools integration causes slow requests — MediaWiki - ReportIncident Extension CWE-770 7.5AI High AI 2026-04-07
CVE-2025-67481 mw.message(…).parse() doesn't output safe HTML, but it's being used as if it does — MediaWiki CWE-79 6.1AI Medium AI 2026-02-03
CVE-2025-67482 Lua segfault in unpack() — Scribunto 9.8AI Critical AI 2026-02-03
CVE-2025-67483 Theoretical i18n XSS in mediawiki.page.preview.js when a page has multiple protection levels — MediaWiki CWE-79 6.1AI Medium AI 2026-02-03
CVE-2025-67484 Action API xslt option allows JavaScript execution by administrators who are not interface administrators — MediaWiki 9.8AI Critical AI 2026-02-03
CVE-2025-67480 list=allrevisions can be used to bypass Extension:Lockdown — MediaWiki 9.8AI Critical AI 2026-02-03
CVE-2025-67475 Stored XSS through edit summaries in MW Core — MediaWiki CWE-79 6.1AI Medium AI 2026-02-03
CVE-2025-67476 Importing leaks IP address of importer via EventStreams — MediaWiki 9.8AI Critical AI 2026-02-03
CVE-2025-67477 Stored XSS through a system message in Special:ApiSandbox — MediaWiki CWE-79 6.1AI Medium AI 2026-02-03
CVE-2025-67478 Wrong E-Mail address composition for usernames with a comma and Umlauts in it like "Döe, Jähn" — CheckUser 9.8AI Critical AI 2026-02-03

This page lists every published CVE security advisory associated with Wikimedia Foundation. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.