The Wikimedia Foundation — recent CVEs https://vulnogram.org/ Most recent CVEs assigned by The Wikimedia Foundation (wikimedia-foundation). https://vulnogram.org/seaview/icons/wikimedia-foundation.png The Wikimedia Foundation — recent CVEs https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT CVE-2026-103585 · 1.2 LOW — attacker-controlled javascript license URL via XSS https://vulnogram.org/CVE-2026-103585 https://vulnogram.org/CVE-2026-103585 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki MediaSearch extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki MediaSearch extension: 1.46, 1.45,… Low Wed, 30 Sep 2026 22:17:37 GMT CVE-2026-103584 · 1.1 LOW — attacker-controlled javascript license URL via XSS https://vulnogram.org/CVE-2026-103584 https://vulnogram.org/CVE-2026-103584 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki CommonsMetadata extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki CommonsMetadata extension: 1.4… Low Wed, 30 Sep 2026 22:14:27 GMT CVE-2026-103440 · 1.2 LOW — pagetriagelist discloses suppressed reviewer usernames https://vulnogram.org/CVE-2026-103440 https://vulnogram.org/CVE-2026-103440 Exposure of sensitive information through data queries vulnerability in The Wikimedia Foundation MediaWiki PageTriage extension allows Information Elicitation. This issue affects MediaWiki PageTriage extension: 1.46, 1.45, and 1.43. Low Wed, 30 Sep 2026 17:38:27 GMT CVE-2026-103439 · 0.3 LOW — Various rawParams() and escaped() updates to prevent XSS in Wikibase extension https://vulnogram.org/CVE-2026-103439 https://vulnogram.org/CVE-2026-103439 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikbase extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki Wikbase extension: 1.46, 1.45, and 1.4… Low Wed, 30 Sep 2026 17:34:10 GMT CVE-2026-103438 · 0.3 LOW — Various rawParams() and escaped() updates to prevent XSS in Wikistories extension https://vulnogram.org/CVE-2026-103438 https://vulnogram.org/CVE-2026-103438 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikistories extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki Wikistories extension: 1.46, 1.45,… Low Wed, 30 Sep 2026 17:32:26 GMT CVE-2026-103437 · 1.1 LOW — ReadingLists imported metadata permits JavaScript URL XSS https://vulnogram.org/CVE-2026-103437 https://vulnogram.org/CVE-2026-103437 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows Reflected XSS. This issue affects MediaWiki ReadingLists extension: 1.46 and 1.45. Low Wed, 30 Sep 2026 17:17:35 GMT CVE-2026-103446 · 7.4 HIGH — WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments https://vulnogram.org/CVE-2026-103446 https://vulnogram.org/CVE-2026-103446 Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass. This issue affects MediaWiki WikiLambda extension: 1.46. High Wed, 30 Sep 2026 17:13:02 GMT CVE-2026-103445 · 1.2 LOW — Stored XSS through PageForms #autoedit redirect links https://vulnogram.org/CVE-2026-103445 https://vulnogram.org/CVE-2026-103445 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Page_Forms extension allows Stored XSS. This issue affects MediaWiki Page_Forms extension: 1.46, 1.45, and 1.43. Low Wed, 30 Sep 2026 17:04:14 GMT CVE-2026-103444 · 1.1 LOW — Stored XSS through system messages in WikiForum https://vulnogram.org/CVE-2026-103444 https://vulnogram.org/CVE-2026-103444 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki WikiForum extension allows Stored XSS. This issue affects MediaWiki WikiForum extension: master. Low Wed, 30 Sep 2026 16:23:56 GMT CVE-2026-103443 · 1.1 LOW — API permits session-seeded javascript URL XSS https://vulnogram.org/CVE-2026-103443 https://vulnogram.org/CVE-2026-103443 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Collection (Book) extension allows XSS Targeting Non-Script Elements. This issue affects MediaWiki Collection (Book) ext… Low Wed, 30 Sep 2026 16:19:16 GMT CVE-2026-103442 · 7.2 HIGH — MergeAccount PHP object injection via session-key substitution https://vulnogram.org/CVE-2026-103442 https://vulnogram.org/CVE-2026-103442 External control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection. This issue affects MediaWiki CentralAuth extension: 1.46, 1.45, and 1.43. High Wed, 30 Sep 2026 16:09:40 GMT CVE-2026-103441 · 7.2 HIGH — Unauthenticated arbitrary file deletion through Wikibase serialized entity parsing https://vulnogram.org/CVE-2026-103441 https://vulnogram.org/CVE-2026-103441 Deserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in Non-Executable Files. This issue affects MediaWiki Wikibase extension: 1.46, 1.45, and 1.43. High Wed, 30 Sep 2026 15:59:42 GMT CVE-2026-103051 · 6.1 MEDIUM 🌩️ — Stored i18n XSSs in CentralNotice https://vulnogram.org/CVE-2026-103051 https://vulnogram.org/CVE-2026-103051 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralNotice extension allows Stored XSS. This issue affects Mediawiki - CentralNotice extension: before 1.46.… Medium Network Exploitable Tue, 29 Sep 2026 23:13:32 GMT CVE-2026-103050 · 6.1 MEDIUM 🌩️ — Stored i18n XSS in MassMessage https://vulnogram.org/CVE-2026-103050 https://vulnogram.org/CVE-2026-103050 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - MassMessage extension allows Stored XSS. This issue affects Mediawiki - MassMessage extension: before 1.46.1, 1… Medium Network Exploitable Tue, 29 Sep 2026 23:11:02 GMT CVE-2026-103049 · 6.1 MEDIUM 🌩️ — XSS in Cargo's Special:CargoQuery page due to unsanitized table headers https://vulnogram.org/CVE-2026-103049 https://vulnogram.org/CVE-2026-103049 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: before 1.46.1. Medium Network Exploitable Tue, 29 Sep 2026 23:08:30 GMT CVE-2026-103048 · 6.1 MEDIUM 🌩️ — Open Redirect in Special:Book https://vulnogram.org/CVE-2026-103048 https://vulnogram.org/CVE-2026-103048 URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - Collection extension allows Fake the Source of Data. This issue affects Mediawiki - Collection extension: before 1.46.1, 1.45.5, 1.43.10. Medium Network Exploitable Tue, 29 Sep 2026 23:04:48 GMT CVE-2026-103047 · 6.1 MEDIUM 🌩️ — XSS through i18n message in CentralAuth https://vulnogram.org/CVE-2026-103047 https://vulnogram.org/CVE-2026-103047 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth extension allows Stored XSS. This issue affects Mediawiki - CentralAuth extension: before 1.46.1, 1… Medium Network Exploitable Tue, 29 Sep 2026 22:59:48 GMT CVE-2026-103045 · 6.1 MEDIUM 🌩️ — XSS in Refreshed skin https://vulnogram.org/CVE-2026-103045 https://vulnogram.org/CVE-2026-103045 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Refreshed skin allows Stored XSS. This issue affects Mediawiki - Refreshed skin: before 1.46.1, 1.45.5, 1.43.10… Medium Network Exploitable Tue, 29 Sep 2026 22:51:04 GMT CVE-2026-103044 · 9.8 CRITICAL 🌩️ — EasyTimeline should not serve image maps as application/xml https://vulnogram.org/CVE-2026-103044 https://vulnogram.org/CVE-2026-103044 XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection. This issue affects Mediawiki - EasyTimeline extension: before 1.46.1, 1.45.5, 1.43.10. Critical Network Exploitable Tue, 29 Sep 2026 22:46:46 GMT CVE-2026-103046 · 6.1 MEDIUM 🌩️ — WikifunctionsFragmentRenderer does unsafe string replacements on user-provided HTML https://vulnogram.org/CVE-2026-103046 https://vulnogram.org/CVE-2026-103046 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation MediaWiki - WikiLambda extension allows Stored XSS. This issue affects MediaWiki - WikiLambda extension: before 1.46.1. Medium Network Exploitable Tue, 29 Sep 2026 22:41:36 GMT CVE-2026-102796 · 7.5 HIGH 🌩️ — Unauthenticated SQL injection in UserPageViewTracker via filterusers and ignoreusers parameters https://vulnogram.org/CVE-2026-102796 https://vulnogram.org/CVE-2026-102796 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wikimedia Foundation Mediawiki - UserPageViewTracker Extension allows SQL Injection. This issue affects Mediawiki - UserPageViewTracker Extension: f… High Network Exploitable Tue, 29 Sep 2026 16:55:37 GMT CVE-2026-100245 · 6.1 MEDIUM 🌩️ — Stored XSS on Wikibase Special:SetSiteLink via unescaped system message https://vulnogram.org/CVE-2026-100245 https://vulnogram.org/CVE-2026-100245 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows Stored XSS. This issue affects Mediawiki - Wikibase Extension: from * before 1.46.… Medium Network Exploitable Tue, 29 Sep 2026 16:52:54 GMT CVE-2026-100244 · 7.5 HIGH 🌩️ — CentralAuth exposes locally suppressed block information via globaluserinfo API and Special:CentralAuth (incomplete fix for CVE-2025-62669) https://vulnogram.org/CVE-2026-100244 https://vulnogram.org/CVE-2026-100244 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows Excavation. This issue affects Mediawiki - CentralAuth Extension: from * before 1.46.1, 1.45.5, 1.43.10. High Network Exploitable Tue, 29 Sep 2026 16:48:28 GMT CVE-2026-100243 · 6.1 MEDIUM 🌩️ — Stored XSS in WikiSEO author and image properties on action=info https://vulnogram.org/CVE-2026-100243 https://vulnogram.org/CVE-2026-100243 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - WikiSEO Extension allows Stored XSS. This issue affects Mediawiki - WikiSEO Extension: from * before 1.46.1,… Medium Network Exploitable Tue, 29 Sep 2026 16:43:00 GMT CVE-2026-100242 · 7.5 HIGH 🌩️ — DataTransfer depends on phpspreadsheet version vulnerable to CVE-2026-59933 (XLS/OLE memory exhaustion) https://vulnogram.org/CVE-2026-100242 https://vulnogram.org/CVE-2026-100242 Dependency on Vulnerable Third-Party Component and Uncontrolled Resource Consumption vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows Excessive Allocation. This issue affects Mediawiki - DataTransfer Extension: from 1.4… High Network Exploitable Tue, 29 Sep 2026 16:40:18 GMT CVE-2026-100241 · 7.5 HIGH 🌩️ — Private change tags exposed to anonymous users via revision-tags-change events https://vulnogram.org/CVE-2026-100241 https://vulnogram.org/CVE-2026-100241 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - EventBus Extension allows Excavation. This issue affects Mediawiki - EventBus Extension: 1.47.0-alpha. High Network Exploitable Tue, 29 Sep 2026 16:36:22 GMT CVE-2026-100240 · 9.1 CRITICAL 🌩️ — TemplateSandbox does not check read permissions for the page being previewed https://vulnogram.org/CVE-2026-100240 https://vulnogram.org/CVE-2026-100240 Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - TemplateSandbox Extension: from * before 1.46.1, 1.45.5,… Critical Network Exploitable Tue, 29 Sep 2026 16:26:31 GMT CVE-2026-100238 · 6.1 MEDIUM 🌩️ — Flow colon-separator and flow-guidedtour-optin-welcome-description messages allow stored XSS https://vulnogram.org/CVE-2026-100238 https://vulnogram.org/CVE-2026-100238 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Flow Extension allows Stored XSS. This issue affects Mediawiki - Flow Extension: from * before 1.46.1, 1.45.… Medium Network Exploitable Tue, 29 Sep 2026 16:12:06 GMT CVE-2026-100383 · 4.8 MEDIUM — Stored i18n XSS in WikiLambda's VisualEditor integration https://vulnogram.org/CVE-2026-100383 https://vulnogram.org/CVE-2026-100383 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - WikiLambda Extension:… Medium Fri, 25 Sep 2026 21:05:51 GMT CVE-2026-100382 · 10 CRITICAL 🌩️ — Unauthenticated remote code execution through wikitext in ExternalData https://vulnogram.org/CVE-2026-100382 https://vulnogram.org/CVE-2026-100382 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Wikimedia Foundation Mediawiki - ExternalData Extension allows OS Command Injection. This issue affects Mediawiki - ExternalData Extension: fr… Critical Network Exploitable Fri, 25 Sep 2026 21:04:02 GMT CVE-2026-100381 · 5.3 MEDIUM 🌩️ — UploadWizard Flickr collection and set titles allow DOM XSS https://vulnogram.org/CVE-2026-100381 https://vulnogram.org/CVE-2026-100381 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - UploadWizard Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - UploadWizard Extens… Medium Network Exploitable Fri, 25 Sep 2026 21:00:42 GMT CVE-2026-100380 · 5.3 MEDIUM 🌩️ — Reflected XSS in Wikibase Special:SetLabel language validation https://vulnogram.org/CVE-2026-100380 https://vulnogram.org/CVE-2026-100380 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - Wikibase Extension: fro… Medium Network Exploitable Fri, 25 Sep 2026 20:58:24 GMT CVE-2026-100379 · 5.3 MEDIUM 🌩️ — Cross-request disclosure of CentralAuth cookies in Wikipedia Android App https://vulnogram.org/CVE-2026-100379 https://vulnogram.org/CVE-2026-100379 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Wikipedia Android App allows Accessing/Intercepting/Modifying HTTP Cookies. This issue affects Wikipedia Android App: main. Medium Network Exploitable Fri, 25 Sep 2026 20:54:08 GMT CVE-2026-100378 · 5.3 MEDIUM — Missing permission check in the Translate sandbox doRemind action https://vulnogram.org/CVE-2026-100378 https://vulnogram.org/CVE-2026-100378 Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - Translate Extension allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - Translate Extension: from * before 1.46.1, 1.45.5, 1.43.10. Medium Fri, 25 Sep 2026 20:50:28 GMT CVE-2026-100376 · 4.8 MEDIUM — TemplateSandbox can be abused for XSS by asking another user to preview a page with a certain sandbox prefix https://vulnogram.org/CVE-2026-100376 https://vulnogram.org/CVE-2026-100376 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - TemplateSandbox… Medium Fri, 25 Sep 2026 20:48:53 GMT CVE-2026-100377 · 6.9 MEDIUM 🌩️ — Revision-deleted pages can be viewed through WikiLambda's action=edit and Special:ViewAbstract https://vulnogram.org/CVE-2026-100377 https://vulnogram.org/CVE-2026-100377 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Excavation. This issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has been remediated on t… Medium Network Exploitable Fri, 25 Sep 2026 20:47:36 GMT CVE-2026-96879 · 6.9 MEDIUM 🌩️ — "Checked by" label in page history should not be shown if the underlying review log entry is suppressed" https://vulnogram.org/CVE-2026-96879 https://vulnogram.org/CVE-2026-96879 Improper removal of sensitive information before storage or transfer vulnerability in Wikimedia Foundation's Mediawiki - FlaggedRevs extension through 1.46.0. Medium Network Exploitable Fri, 25 Sep 2026 20:10:22 GMT CVE-2026-96878 · 6.9 MEDIUM 🌩️ — Cargo Exhibit field alias allows stored XSS https://vulnogram.org/CVE-2026-96878 https://vulnogram.org/CVE-2026-96878 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4. Medium Network Exploitable Fri, 25 Sep 2026 19:41:56 GMT CVE-2026-96877 · 6.9 MEDIUM 🌩️ — Reflected XSS through Cargo Drilldown full-text search https://vulnogram.org/CVE-2026-96877 https://vulnogram.org/CVE-2026-96877 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4. Medium Network Exploitable Fri, 25 Sep 2026 19:39:30 GMT CVE-2026-96876 · 6.9 MEDIUM 🌩️ — Anonymous reflected XSS in CargoExport invalid-alias errors https://vulnogram.org/CVE-2026-96876 https://vulnogram.org/CVE-2026-96876 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4. Medium Network Exploitable Fri, 25 Sep 2026 19:33:17 GMT CVE-2026-96875 · 6.9 MEDIUM 🌩️ — Reflected XSS in Cargo Drilldown hierarchy filters https://vulnogram.org/CVE-2026-96875 https://vulnogram.org/CVE-2026-96875 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4. Medium Network Exploitable Fri, 25 Sep 2026 19:29:19 GMT CVE-2026-100237 · 6.1 MEDIUM 🌩️ — Stored i18n XSS in the Flow integration of Thanks https://vulnogram.org/CVE-2026-100237 https://vulnogram.org/CVE-2026-100237 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Thanks Extension allows Stored XSS. This issue affects Mediawiki - Thanks Extension: from * before 1.43.10/1.45… Medium Network Exploitable Fri, 25 Sep 2026 16:47:40 GMT CVE-2026-96874 · 2.3 LOW — Stored XSS in Cargo Drilldown tab names https://vulnogram.org/CVE-2026-96874 https://vulnogram.org/CVE-2026-96874 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in the Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4. Low Fri, 25 Sep 2026 14:59:58 GMT CVE-2026-96873 · 5.5 MEDIUM 🌩️ — Reflected XSS in CirrusSearch debug explain output https://vulnogram.org/CVE-2026-96873 https://vulnogram.org/CVE-2026-96873 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - CirrusSearch extension allows Reflected XSS. This issue affects Mediawiki - CirrusSearch extension through 1.46.0. Medium Network Exploitable Thu, 24 Sep 2026 15:27:31 GMT CVE-2026-96872 · 2.9 LOW 🌩️ — WikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositions https://vulnogram.org/CVE-2026-96872 https://vulnogram.org/CVE-2026-96872 Improper handling of insufficient permissions or privileges vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension on Linux, MacOS, and Windows allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Me… Low Network Exploitable Wed, 23 Sep 2026 18:50:13 GMT CVE-2026-14363 · 6.9 MEDIUM 🌩️ — Cargo Extension: SQLi in Special:Drilldown https://vulnogram.org/CVE-2026-14363 https://vulnogram.org/CVE-2026-14363 Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44… Medium Network Exploitable Wed, 01 Jul 2026 19:22:33 GMT CVE-2026-14358 · 6.9 MEDIUM 🌩️ — Stored XSS in Wikimedia Chart pie tooltip via Data:*.tab field title https://vulnogram.org/CVE-2026-14358 https://vulnogram.org/CVE-2026-14358 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Charts Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - Charts Extension: from * bef… Medium Network Exploitable Wed, 01 Jul 2026 18:48:55 GMT CVE-2026-58517 · 6.9 MEDIUM 🌩️ — Blocked users can create and edit WikiLambda objects https://vulnogram.org/CVE-2026-58517 https://vulnogram.org/CVE-2026-58517 Improper neutralization of input terminators vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Authentication Bypass. This issue affects Mediawiki - WikiLambda Extension: from * before 1.43.9,1.44.6,1.45.4. Medium Network Exploitable Wed, 01 Jul 2026 18:23:02 GMT CVE-2026-58521 · 6.9 MEDIUM 🌩️ — SQLi in Cargo extension via year range filter https://vulnogram.org/CVE-2026-58521 https://vulnogram.org/CVE-2026-58521 Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44… Medium Network Exploitable Wed, 01 Jul 2026 17:30:50 GMT CVE-2026-58520 · 6.9 MEDIUM 🌩️ — UrlShortener defaults to ineffective validation open to third-party redirects https://vulnogram.org/CVE-2026-58520 https://vulnogram.org/CVE-2026-58520 URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - UrlShortener Extension allows Cross-Site Flashing. This issue affects Mediawiki - UrlShortener Extension: from * before 1.43.9, 1.44.6, 1.45.4. Medium Network Exploitable Wed, 01 Jul 2026 17:14:06 GMT