Threat database

Improper input validation vulnerability in Wikimedia Foundation UrlShortener. This vulnerability is associated with program files includes/UrlShortenerUtils.Php.

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandboxLayout.Js. This issue affects MediaWiki: from 1.46.0-rc.0 before 1.46.0.

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files modules/ext.CheckUser.TempAccounts/components/blockConnectedTempAccountsField.Vue. This issue affects CheckUser: from 1.46.0-rc.0 before 1.46.0.

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Block/SpecialBlock.Vue.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS. This issue affects Mediawiki - Cargo Extension: from * before 3.9.1.

Cross-Site request forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - RedirectManager Extension allows Cross Site Request Forgery. This issue affects Mediawiki - RedirectManager Extension: from * before 1.3.3.

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Echo. This vulnerability is associated with program files includes/Api/ApiEchoNotifications.Php. This issue affects Echo: from * before 1.43.7, 1.44.4, 1.45.2.

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Page/Article.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Specials/SpecialUserRights.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Skin/Skin.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation CheckUser. This issue affects CheckUser: from 1.45.0 before 1.45.2.

Vulnerability in Wikimedia Foundation Scribunto. This issue affects Scribunto: from 1.45.0 before 1.45.2.

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation OATHAuth. This issue affects OATHAuth: from * before 1.43.7, 1.44.4, 1.45.2.

CVE-2026-34086 is a low-severity vulnerability affecting the Wikimedia Foundation's AbuseFilter component in versions before 1.43.7, 1.44.4, and 1.45.2. The vulnerability relates to improper input validation (CWE-20). There is no vendor-provided remediation level or patch information available at this time. The vulnerability has a low CVSS 4.

CVE-2026-39936 is a cross-site scripting (XSS) vulnerability in the Mediawiki Score Extension maintained by The Wikimedia Foundation. The vulnerability arises from improper neutralization of input during web page generation, which could allow injection of malicious scripts. This issue has been fixed in the master branch and in release branches for MediaWiki versions 1.43, 1.44, and 1.45. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity level. There are no known exploits in the wild at this time.

CVE-2026-39935 is a medium severity cross-site scripting (XSS) vulnerability in the CampaignEvents Extension of The Wikimedia Foundation's Mediawiki. It arises from improper neutralization of input during web page generation, allowing injection of malicious scripts. The issue affects versions 1.43, 1.44, 1.45, and 0 of the extension. The vulnerability has been remediated only on the master branch, with no official patch or fix released for the affected versions at the time of this report. There are no known exploits in the wild currently.

CVE-2026-39934 is a medium severity vulnerability in the Wikimedia Foundation's Mediawiki GrowthExperiments Extension. It involves an infinite loop caused by a loop with an unreachable exit condition, which can be leveraged through TOCTOU race conditions. The issue affects multiple versions including 1.43, 1.44, and 1.45. A fix has been applied only on the master branch, but no official patch or remediation level has been confirmed. There are no known exploits in the wild at this time.

CVE-2026-39933 is a cross-site scripting (XSS) vulnerability in the Wikimedia Foundation's Mediawiki GlobalWatchlist Extension. It arises from improper neutralization of input during web page generation. This vulnerability has been fixed in the master branch and in release branches for MediaWiki versions 1.43, 1.44, and 1.45. The CVSS 4.0 base score is 6.9, indicating a medium severity level. No known exploits are reported in the wild.