# Wikimedia Foundation MediaWiki. Every CVE that names Wikimedia Foundation MediaWiki among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [Remote Code Execution via Unsafe Deserialization in LogItem Import](https://agentprime.io/advisories/CVE-2026-58025.md) `CVE-2026-58025` · CVE record: Wikimedia Foundation MediaWiki · CVSS 5.9 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: Code injection, Insecure deserialization - [Full Account Takeover from BotPasswords and OAuth via action=changeauthenticationdata](https://agentprime.io/advisories/CVE-2026-58029.md) `CVE-2026-58029` · CVE record: Wikimedia Foundation MediaWiki · CVSS 5.3 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: Authentication bypass - [Pretty-printed API output combined with centralauthtoken allows XSS with certain gadgets](https://agentprime.io/advisories/CVE-2026-58028.md) `CVE-2026-58028` · CVE record: Wikimedia Foundation MediaWiki and 1 more · CVSS 0.0 None · Not analysed yet · Published 1 Jul 2026 · Tags: Cross-site scripting (XSS) - [$wgNonincludableNamespaces can be bypassed by embedding redirect in other namespaces](https://agentprime.io/advisories/CVE-2026-58026.md) `CVE-2026-58026` · CVE record: Wikimedia Foundation MediaWiki · CVSS 0.0 None · Not analysed yet · Published 1 Jul 2026 · Tags: Information disclosure - [mw.Api.getErrorMessage() may return injected HTML if used without errorformat=html](https://agentprime.io/advisories/CVE-2026-58032.md) `CVE-2026-58032` · CVE record: Wikimedia Foundation MediaWiki · CVSS 5.3 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: Cross-site scripting (XSS) - ["Total number of distinct authors" statistic at action=info does not exclude revisions where the author name was deleted](https://agentprime.io/advisories/CVE-2026-58033.md) `CVE-2026-58033` · CVE record: Wikimedia Foundation MediaWiki · CVSS 5.3 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: Information disclosure - [Core log entries for exceptions and XSS issues in log entry formatting code that may be caused by user-controlled input](https://agentprime.io/advisories/CVE-2026-58037.md) `CVE-2026-58037` · CVE record: Wikimedia Foundation MediaWiki · CVSS 0.0 None · Not analysed yet · Published 1 Jul 2026 · Tags: Cross-site scripting (XSS) - [Users API leaks whether privileged users have their user groups disabled for lack of 2FA](https://agentprime.io/advisories/CVE-2026-58036.md) `CVE-2026-58036` · CVE record: Wikimedia Foundation MediaWiki · CVSS 2.1 Low · Not analysed yet · Published 1 Jul 2026 · Tags: Information disclosure - [API identification of users on private wikis](https://agentprime.io/advisories/CVE-2026-58024.md) `CVE-2026-58024` · CVE record: Wikimedia Foundation MediaWiki · CVSS 5.1 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: Information disclosure - [Stored i18n XSS in Special:ApiSandbox when a deprecated module is selected](https://agentprime.io/advisories/CVE-2026-58031.md) `CVE-2026-58031` · CVE record: Wikimedia Foundation MediaWiki · CVSS 0.0 None · Not analysed yet · Published 1 Jul 2026 · Tags: Cross-site scripting (XSS) - [Stored XSS through a system message in the codex version of Special:Block](https://agentprime.io/advisories/CVE-2026-58035.md) `CVE-2026-58035` · CVE record: Wikimedia Foundation MediaWiki · CVSS 0.0 None · Not analysed yet · Published 1 Jul 2026 · Tags: Cross-site scripting (XSS) - [action=raw with Special:Mypage subpage title responds with "Content-Type: text/html" on ctype=text/javascript request](https://agentprime.io/advisories/CVE-2026-34095.md) `CVE-2026-34095` · CVE record: Wikimedia Foundation MediaWiki · CVSS 0.0 None · Not analysed yet · Published 11 May 2026 · Tags: Information disclosure - [Customized help link for page protection indicator is relative to subpage name, because the link target is missing the "/wiki/" prefix](https://agentprime.io/advisories/CVE-2026-34094.md) `CVE-2026-34094` · CVE record: Wikimedia Foundation MediaWiki · CVSS 2.0 Low · Not analysed yet · Published 11 May 2026 · Tags: Information disclosure - [Special:UserRights allows viewing user rights from private wiki](https://agentprime.io/advisories/CVE-2026-34093.md) `CVE-2026-34093` · CVE record: Wikimedia Foundation MediaWiki · CVSS 1.1 Low · Not analysed yet · Published 11 May 2026 · Tags: Information disclosure - [Block UI elements in 'tools'-sidebar shows presence of an autoblocked IP](https://agentprime.io/advisories/CVE-2026-34092.md) `CVE-2026-34092` · CVE record: Wikimedia Foundation MediaWiki · CVSS 2.1 Low · Not analysed yet · Published 11 May 2026 · Tags: Information disclosure - [User localization leaked by AbuseFilter + EventStream](https://agentprime.io/advisories/CVE-2026-34091.md) `CVE-2026-34091` · CVE record: Wikimedia Foundation MediaWiki · CVSS 5.5 Medium · Not analysed yet · Published 11 May 2026 · Tags: Information disclosure - [RecentChanges entries expose suppressed content via generated log page html](https://agentprime.io/advisories/CVE-2026-34088.md) `CVE-2026-34088` · CVE record: Wikimedia Foundation MediaWiki · CVSS 1.3 Low · Not analysed yet · Published 11 May 2026 · Tags: Information disclosure - [mw.message(…).parse() doesn't output safe HTML, but it's being used as if it does](https://agentprime.io/advisories/CVE-2025-67481.md) `CVE-2025-67481` · CVE record: Wikimedia Foundation MediaWiki · CVSS 0.0 None · Not analysed yet · Published 3 Feb 2026 · Tags: Cross-site scripting (XSS) - [Theoretical i18n XSS in mediawiki.page.preview.js when a page has multiple protection levels](https://agentprime.io/advisories/CVE-2025-67483.md) `CVE-2025-67483` · CVE record: Wikimedia Foundation MediaWiki · CVSS 0.0 None · Not analysed yet · Published 3 Feb 2026 · Tags: Cross-site scripting (XSS) - [Action API xslt option allows JavaScript execution by administrators who are not interface administrators](https://agentprime.io/advisories/CVE-2025-67484.md) `CVE-2025-67484` · CVE record: Wikimedia Foundation MediaWiki · CVSS 0.0 None · Not analysed yet · Published 3 Feb 2026 · Tags: CWE-20 - [list=allrevisions can be used to bypass Extension:Lockdown](https://agentprime.io/advisories/CVE-2025-67480.md) `CVE-2025-67480` · CVE record: Wikimedia Foundation MediaWiki · CVSS 0.0 None · Not analysed yet · Published 3 Feb 2026 · Tags: CWE-20 - [Stored XSS through edit summaries in MW Core](https://agentprime.io/advisories/CVE-2025-67475.md) `CVE-2025-67475` · CVE record: Wikimedia Foundation MediaWiki · CVSS 0.0 None · Not analysed yet · Published 3 Feb 2026 · Tags: Cross-site scripting (XSS) - [Importing leaks IP address of importer via EventStreams](https://agentprime.io/advisories/CVE-2025-67476.md) `CVE-2025-67476` · CVE record: Wikimedia Foundation MediaWiki · CVSS 1.3 Low · Not analysed yet · Published 3 Feb 2026 - [Stored XSS through a system message in Special:ApiSandbox](https://agentprime.io/advisories/CVE-2025-67477.md) `CVE-2025-67477` · CVE record: Wikimedia Foundation MediaWiki · CVSS 0.0 None · Not analysed yet · Published 3 Feb 2026 · Tags: Cross-site scripting (XSS) - [Magic word replacement in legacy parser allows using reserved data attributes through wikitext](https://agentprime.io/advisories/CVE-2025-67479.md) `CVE-2025-67479` · CVE record: Wikimedia Foundation MediaWiki and 1 more · CVSS 0.0 None · Not analysed yet · Published 3 Feb 2026 - [Stored i18n XSS exposed by security patch for T402077](https://agentprime.io/advisories/CVE-2025-11261.md) `CVE-2025-11261` · CVE record: Wikimedia Foundation MediaWiki · CVSS 0.0 None · Not analysed yet · Published 3 Feb 2026 · Tags: Cross-site scripting (XSS) - [CodexTablePager has i18n XSS](https://agentprime.io/advisories/CVE-2025-61645.md) `CVE-2025-61645` · CVE record: Wikimedia Foundation MediaWiki · CVSS 0.0 None · Not analysed yet · Published 3 Feb 2026 · Tags: Cross-site scripting (XSS) - [Watchlist group mode reveals authors of edits with hidden authorship](https://agentprime.io/advisories/CVE-2025-61646.md) `CVE-2025-61646` · CVE record: Wikimedia Foundation MediaWiki · CVSS 1.2 Low · Not analysed yet · Published 3 Feb 2026 · Tags: Path traversal - [i18n XSS through Special:Watchlist](https://agentprime.io/advisories/CVE-2025-61644.md) `CVE-2025-61644` · CVE record: Wikimedia Foundation MediaWiki · CVSS 0.0 None · Not analysed yet · Published 2 Feb 2026 · Tags: Cross-site scripting (XSS) - [Stored XSS through system messages in MW Core](https://agentprime.io/advisories/CVE-2025-61637.md) `CVE-2025-61637` · CVE record: Wikimedia Foundation MediaWiki · CVSS 0.0 None · Not analysed yet · Published 2 Feb 2026 · Tags: Cross-site scripting (XSS) - [Sanitizer::validateAttributes data-XSS](https://agentprime.io/advisories/CVE-2025-61638.md) `CVE-2025-61638` · CVE record: Wikimedia Foundation MediaWiki and 1 more · CVSS 0.0 None · Not analysed yet · Published 2 Feb 2026 · Tags: Cross-site scripting (XSS) - [Suppressed blocked IP is visible in Special:BlockList, RC, and other places](https://agentprime.io/advisories/CVE-2025-61639.md) `CVE-2025-61639` · CVE record: Wikimedia Foundation MediaWiki · CVSS 1.7 Low · Not analysed yet · Published 2 Feb 2026 · Tags: Information disclosure - [Stored XSS through system messages in Special:RecentChangesLinked (MW Core)](https://agentprime.io/advisories/CVE-2025-61640.md) `CVE-2025-61640` · CVE record: Wikimedia Foundation MediaWiki · CVSS 0.0 None · Not analysed yet · Published 2 Feb 2026 · Tags: Cross-site scripting (XSS) - [API list=allpages with maxsize is making really slow queries](https://agentprime.io/advisories/CVE-2025-61641.md) `CVE-2025-61641` · CVE record: Wikimedia Foundation MediaWiki · CVSS 1.7 Low · Not analysed yet · Published 2 Feb 2026 · Tags: Path traversal - [Stored XSS through system messages provided to CodexHtmlForms](https://agentprime.io/advisories/CVE-2025-61642.md) `CVE-2025-61642` · CVE record: Wikimedia Foundation MediaWiki · CVSS 0.0 None · Not analysed yet · Published 2 Feb 2026 · Tags: Cross-site scripting (XSS) - [EventStreams publishes suppressed recent change entries that are suppressed from their creation](https://agentprime.io/advisories/CVE-2025-61643.md) `CVE-2025-61643` · CVE record: Wikimedia Foundation MediaWiki · CVSS 2.7 Low · Not analysed yet · Published 2 Feb 2026 - [HTML rest endpoint needs PoolCounter and proper parser cache check](https://agentprime.io/advisories/CVE-2025-61634.md) `CVE-2025-61634` · CVE record: Wikimedia Foundation MediaWiki · CVSS 0.0 None · Not analysed yet · Published 2 Feb 2026 - [Codex Special:Block vulnerable to message key XSS](https://agentprime.io/advisories/CVE-2025-61636.md) `CVE-2025-61636` · CVE record: Wikimedia Foundation MediaWiki · CVSS 0.0 None · Not analysed yet · Published 2 Feb 2026 · Tags: Cross-site scripting (XSS) - [With MultiBlocks enabled and a user who is suppressed via a MultiBlock, a user without 'hideuser' can see the hidden username in the BlockList](https://agentprime.io/advisories/CVE-2025-6589.md) `CVE-2025-6589` · CVE record: Wikimedia Foundation MediaWiki · CVSS 2.1 Low · Not analysed yet · Published 2 Feb 2026 · Tags: Path traversal - [Complete content leak of private wikis due to PasswordReset Wikitext injection in error message](https://agentprime.io/advisories/CVE-2025-6590.md) `CVE-2025-6590` · CVE record: Wikimedia Foundation MediaWiki · CVSS 4.6 Medium · Not analysed yet · Published 2 Feb 2026 · Tags: Information disclosure - [HTML injection in API action=feedcontributions output from i18n message](https://agentprime.io/advisories/CVE-2025-6591.md) `CVE-2025-6591` · CVE record: Wikimedia Foundation MediaWiki · CVSS 0.0 None · Not analysed yet · Published 2 Feb 2026 · Tags: Cross-site scripting (XSS) - ["{{SITENAME}} registered email address has been changed" email sent to unverified email addresses](https://agentprime.io/advisories/CVE-2025-6593.md) `CVE-2025-6593` · CVE record: Wikimedia Foundation MediaWiki · CVSS 2.1 Low · Not analysed yet · Published 2 Feb 2026 · Tags: Information disclosure - [XSS in Special:ApiSandbox](https://agentprime.io/advisories/CVE-2025-6594.md) `CVE-2025-6594` · CVE record: Wikimedia Foundation MediaWiki · CVSS 0.0 None · Not analysed yet · Published 2 Feb 2026 · Tags: Cross-site scripting (XSS) - [MediaWiki should not consider autocreation as login for the purposes of security reauthentication](https://agentprime.io/advisories/CVE-2025-6597.md) `CVE-2025-6597` · CVE record: Wikimedia Foundation MediaWiki · CVSS 0.0 None · Not analysed yet · Published 2 Feb 2026 · Tags: Path traversal - [Autoblocks from global account suppressions are publicly visible](https://agentprime.io/advisories/CVE-2025-6927.md) `CVE-2025-6927` · CVE record: Wikimedia Foundation MediaWiki · CVSS 2.3 Low · Not analysed yet · Published 2 Feb 2026 · Tags: Path traversal - [AbuseFilter log interfaces expose global private and hidden filters when central DB is not available](https://agentprime.io/advisories/CVE-2025-32700.md) `CVE-2025-32700` · CVE record: Wikimedia Foundation MediaWiki · CVSS 2.3 Low · Not analysed yet · Published 10 Apr 2025 · Tags: Information disclosure - [Potential javascript injection attack enabled by Unicode normalization in Action API](https://agentprime.io/advisories/CVE-2025-32699.md) `CVE-2025-32699` · CVE record: Wikimedia Foundation MediaWiki and 1 more · CVSS 2.1 Low · Not analysed yet · Published 10 Apr 2025 · Tags: Other injection, Cross-site scripting (XSS) - [LogPager.php: Restriction enforcer functions do not correctly enforce suppression restrictions](https://agentprime.io/advisories/CVE-2025-32698.md) `CVE-2025-32698` · CVE record: Wikimedia Foundation MediaWiki · CVSS 2.1 Low · Not analysed yet · Published 10 Apr 2025 · Tags: Information disclosure - [Cascading protection is not preventing file reversions](https://agentprime.io/advisories/CVE-2025-32697.md) `CVE-2025-32697` · CVE record: Wikimedia Foundation MediaWiki · CVSS 0.0 None · Not analysed yet · Published 10 Apr 2025 · Tags: CWE-281 - ["reupload-own" restriction can be bypassed by reverting file](https://agentprime.io/advisories/CVE-2025-32696.md) `CVE-2025-32696` · CVE record: Wikimedia Foundation MediaWiki · CVSS 0.0 None · Not analysed yet · Published 10 Apr 2025 · Tags: CWE-281 - [i18n XSS vulnerability in HTMLMultiSelectField when sections are used](https://agentprime.io/advisories/CVE-2025-3469.md) `CVE-2025-3469` · CVE record: Wikimedia Foundation MediaWiki · CVSS 0.0 None · Not analysed yet · Published 10 Apr 2025 · Tags: Cross-site scripting (XSS) - [Wikimedia Foundation MediaWiki: The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8…](https://agentprime.io/advisories/CVE-2013-4572.md) `CVE-2013-4572` · CVE record: Wikimedia Foundation MediaWiki · No CVSS score · Not analysed yet · Published 6 Feb 2020 - [Wikimedia Foundation MediaWiki: Cross-site scripting (XSS) vulnerability in MediaWiki 1.19.9 before 1.19.10…](https://agentprime.io/advisories/CVE-2013-6451.md) `CVE-2013-6451` · CVE record: Wikimedia Foundation MediaWiki · No CVSS score · Not analysed yet · Published 28 Jan 2020 - [Wikimedia Foundation MediaWiki: The CentralAuth extension for MediaWiki before 1.19.10, 1.2x before 1.21.4…](https://agentprime.io/advisories/CVE-2013-6455.md) `CVE-2013-6455` · CVE record: Wikimedia Foundation MediaWiki · No CVSS score · Not analysed yet · Published 28 Jan 2020 - [Wikimedia Foundation MediaWiki: includes/libs/IEUrlExtension.php in the MediaWiki API in MediaWiki 1.19.x before 1.19.8…](https://agentprime.io/advisories/CVE-2013-4303.md) `CVE-2013-4303` · CVE record: Wikimedia Foundation MediaWiki · No CVSS score · Not analysed yet · Published 11 Dec 2019 ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .