CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,467 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,467
Show in the list
Critical, last 7 days
357
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product mediawiki:mediawiki. Show all products

48 CVEs, showing 1 to 48
CVESeverityTitlePublished
CVE-2026-58517Medium 4.3Improper neutralization of input terminators vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Authentication Bypass.Jul 1, 2026
CVE-2026-14358Medium 6.1Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Charts Extension allows Cross-Site Scripting (XSS).Jul 1, 2026
CVE-2026-58520Medium 6.1URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - UrlShortener Extension allows Cross-Site Flashing.Jul 1, 2026
CVE-2026-8857High 8.8A vulnerability in Wikimedia Foundation timeline.Jul 1, 2026
CVE-2026-58038Medium 6.1Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation timeline.Jul 1, 2026
CVE-2026-58037Medium 6.1Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.Jul 1, 2026
CVE-2026-58036High 7.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.Jul 1, 2026
CVE-2026-58033Medium 6.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.Jul 1, 2026
CVE-2026-58032Medium 6.1Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.Jul 1, 2026
CVE-2026-58030Medium 6.1Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation SyntaxHighlight_GeSHi.Jul 1, 2026
CVE-2026-58029Medium 6.5Vulnerability in Wikimedia Foundation MediaWiki.Jul 1, 2026
CVE-2026-58028Medium 5.4Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation CentralAuth.Jul 1, 2026
CVE-2026-58027Medium 6.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter.Jul 1, 2026
CVE-2026-58026Medium 5.7Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.Jul 1, 2026
CVE-2026-58025Critical 9.8Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki.Jul 1, 2026
CVE-2026-58024Medium 5.7Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.Jul 1, 2026
CVE-2026-13707High 7.6Session fixation vulnerability in Wikimedia Foundation OAuth.Jul 1, 2026
CVE-2026-13706High 8.8Improper input validation vulnerability in Wikimedia Foundation UrlShortener.Jul 1, 2026
CVE-2026-58035Medium 4.8Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.Jul 1, 2026
CVE-2026-58034Medium 4.8Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser.Jul 1, 2026
CVE-2026-58031Medium 5.4Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.Jul 1, 2026
CVE-2026-58518Medium 6.3Cross-Site request forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - RedirectManager Extension allows Cross Site Request Forgery.Jul 1, 2026
CVE-2026-34095Medium 6.1Vulnerability in Wikimedia Foundation MediaWiki.May 11, 2026
CVE-2026-34094Low 3.8Vulnerability in Wikimedia Foundation MediaWiki.May 11, 2026
CVE-2026-34093Medium 5.3Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.May 11, 2026
CVE-2026-34092High 7.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.May 11, 2026
CVE-2026-34091High 7.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.May 11, 2026
CVE-2026-34088High 7.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.May 11, 2026
CVE-2026-34087High 7.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation OATHAuth.May 11, 2026
CVE-2025-67484Critical 9.8Vulnerability in Wikimedia Foundation MediaWiki.Feb 3, 2026
CVE-2025-67483Medium 6.1Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.Feb 3, 2026
CVE-2025-67481Medium 6.1Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.Feb 3, 2026
CVE-2025-67480Medium 6.5Vulnerability in Wikimedia Foundation MediaWiki.Feb 3, 2026
CVE-2025-67477Medium 6.1Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.Feb 3, 2026
CVE-2025-67476Medium 4.3Vulnerability in Wikimedia Foundation MediaWiki.Feb 3, 2026
CVE-2025-67475Medium 6.1Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.Feb 3, 2026
CVE-2025-61646Medium 5.4Vulnerability in Wikimedia Foundation MediaWiki.Feb 3, 2026
CVE-2025-61645Medium 6.1Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.Feb 3, 2026
CVE-2025-11261Medium 6.1Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.Feb 3, 2026
CVE-2025-61643Medium 6.1Vulnerability in Wikimedia Foundation MediaWiki.Feb 3, 2026
CVE-2025-61642Medium 6.1Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.Feb 3, 2026
CVE-2025-61641Medium 6.1Vulnerability in Wikimedia Foundation MediaWiki.Feb 3, 2026
CVE-2025-61640Medium 4.8Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.Feb 3, 2026
CVE-2025-61639Medium 4.8Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.Feb 3, 2026
CVE-2025-61638Medium 4.8Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Parsoid.Feb 3, 2026
CVE-2025-61637Medium 4.8Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.Feb 3, 2026
CVE-2025-61636Medium 4.8Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.Feb 3, 2026
CVE-2025-61634Low 3.1Vulnerability in Wikimedia Foundation MediaWiki.Feb 3, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.