Vulnerabilities in The Wikimedia Foundation
98 resultsCVE-2024-47846MEDIUMSpecial:DeleteCargoTable and Special:SwitchCargoTable have no CSRF protectionEPSS 0.3%CVE-2026-103584LOWattacker-controlled javascript license URL via XSSEPSS 0.3%CVE-2026-58520MEDIUMUrlShortener defaults to ineffective validation open to third-party redirectsEPSS 0.3%CVE-2026-103441HIGHUnauthenticated arbitrary file deletion through Wikibase serialized entity parsingEPSS 0.3%CVE-2026-103442HIGHMergeAccount PHP object injection via session-key substitutionEPSS 0.3%CVE-2025-32068MEDIUMRevoking authorization of OAuth2 consumer does not invalidate refresh tokensEPSS 0.3%CVE-2026-39936MEDIUMStored XSS in Score due to usage of non-reserved data attributesEPSS 0.3%CVE-2026-22711MEDIUMStored XSS through system messages in WikiLoveEPSS 0.3%CVE-2026-39935MEDIUMXSS-via-i18n in localised wiki namesEPSS 0.3%CVE-2026-39937HIGHGlobal vanishing does not completely remove user emailEPSS 0.3%CVE-2026-103440LOWpagetriagelist discloses suppressed reviewer usernamesEPSS 0.3%CVE-2025-62657MEDIUMStored XSS through system messages in PageFormsEPSS 0.3%CVE-2025-62656MEDIUMGlobalBlocking Special:GlobalBlockList vulnerable to message key stored XSSEPSS 0.3%CVE-2026-96879MEDIUM"Checked by" label in page history should not be shown if the underlying review log entry is suppressed"EPSS 0.3%CVE-2026-96874LOWStored XSS in Cargo Drilldown tab namesEPSS 0.3%CVE-2025-62658HIGHSQL injection in WatchAnalytics through Special:ClearPendingReviewsEPSS 0.2%CVE-2026-58519MEDIUMStored XSS through Cargo's map formatEPSS 0.2%CVE-2026-22712LOWApprovedRevs allows bypassing the inline CSS sanitizerEPSS 0.2%CVE-2025-32071MEDIUMWikibase CommonsInlineImageFormatter: i18n XSSEPSS 0.2%CVE-2025-32073MEDIUMSystem message XSS in HTMLTagsEPSS 0.2%