agentprime: wikimedia-foundation-mediawiki

agentprime: wikimedia-foundation-mediawikiEvery new CVE for wikimedia-foundation-mediawiki.https://agentprime.io/CVE-2026-58025: Remote Code Execution via Unsafe Deserialization in LogItem Importhttps://agentprime.io/advisories/CVE-2026-58025/https://agentprime.io/advisories/CVE-2026-58025/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 01 Jul 2026 15:23:29 GMTCVECVE-2026-58029: Full Account Takeover from BotPasswords and OAuth via action=changeauthenticationdatahttps://agentprime.io/advisories/CVE-2026-58029/https://agentprime.io/advisories/CVE-2026-58029/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 01 Jul 2026 15:19:11 GMTCVECVE-2026-58028: Pretty-printed API output combined with centralauthtoken allows XSS with certain gadgetshttps://agentprime.io/advisories/CVE-2026-58028/https://agentprime.io/advisories/CVE-2026-58028/CVSS 0.0 (None). Published by the CVE Program. Not analysed by agentprime yet.Wed, 01 Jul 2026 15:15:17 GMTCVECVE-2026-58026: $wgNonincludableNamespaces can be bypassed by embedding redirect in other namespaceshttps://agentprime.io/advisories/CVE-2026-58026/https://agentprime.io/advisories/CVE-2026-58026/CVSS 0.0 (None). Published by the CVE Program. Not analysed by agentprime yet.Wed, 01 Jul 2026 15:10:34 GMTCVECVE-2026-58032: mw.Api.getErrorMessage() may return injected HTML if used without errorformat=htmlhttps://agentprime.io/advisories/CVE-2026-58032/https://agentprime.io/advisories/CVE-2026-58032/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 01 Jul 2026 14:56:27 GMTCVECVE-2026-58033: "Total number of distinct authors" statistic at action=info does not exclude revisions where the author name was deletedhttps://agentprime.io/advisories/CVE-2026-58033/https://agentprime.io/advisories/CVE-2026-58033/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 01 Jul 2026 14:54:15 GMTCVECVE-2026-58037: Core log entries for exceptions and XSS issues in log entry formatting code that may be caused by user-controlled inputhttps://agentprime.io/advisories/CVE-2026-58037/https://agentprime.io/advisories/CVE-2026-58037/CVSS 0.0 (None). Published by the CVE Program. Not analysed by agentprime yet.Wed, 01 Jul 2026 14:51:27 GMTCVECVE-2026-58036: Users API leaks whether privileged users have their user groups disabled for lack of 2FAhttps://agentprime.io/advisories/CVE-2026-58036/https://agentprime.io/advisories/CVE-2026-58036/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Wed, 01 Jul 2026 14:48:07 GMTCVECVE-2026-58024: API identification of users on private wikishttps://agentprime.io/advisories/CVE-2026-58024/https://agentprime.io/advisories/CVE-2026-58024/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 01 Jul 2026 14:34:47 GMTCVECVE-2026-58031: Stored i18n XSS in Special:ApiSandbox when a deprecated module is selectedhttps://agentprime.io/advisories/CVE-2026-58031/https://agentprime.io/advisories/CVE-2026-58031/CVSS 0.0 (None). Published by the CVE Program. Not analysed by agentprime yet.Wed, 01 Jul 2026 14:24:21 GMTCVECVE-2026-58035: Stored XSS through a system message in the codex version of Special:Blockhttps://agentprime.io/advisories/CVE-2026-58035/https://agentprime.io/advisories/CVE-2026-58035/CVSS 0.0 (None). Published by the CVE Program. Not analysed by agentprime yet.Wed, 01 Jul 2026 14:17:41 GMTCVECVE-2026-34095: action=raw with Special:Mypage subpage title responds with "Content-Type: text/html" on ctype=text/javascript requesthttps://agentprime.io/advisories/CVE-2026-34095/https://agentprime.io/advisories/CVE-2026-34095/CVSS 0.0 (None). Published by the CVE Program. Not analysed by agentprime yet.Mon, 11 May 2026 16:53:25 GMTCVECVE-2026-34094: Customized help link for page protection indicator is relative to subpage name, because the link target is missing the "/wiki/" prefixhttps://agentprime.io/advisories/CVE-2026-34094/https://agentprime.io/advisories/CVE-2026-34094/CVSS 2.0 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 11 May 2026 16:50:46 GMTCVECVE-2026-34093: Special:UserRights allows viewing user rights from private wikihttps://agentprime.io/advisories/CVE-2026-34093/https://agentprime.io/advisories/CVE-2026-34093/CVSS 1.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 11 May 2026 16:48:19 GMTCVECVE-2026-34092: Block UI elements in 'tools'-sidebar shows presence of an autoblocked IPhttps://agentprime.io/advisories/CVE-2026-34092/https://agentprime.io/advisories/CVE-2026-34092/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 11 May 2026 15:00:29 GMTCVECVE-2026-34091: User localization leaked by AbuseFilter + EventStreamhttps://agentprime.io/advisories/CVE-2026-34091/https://agentprime.io/advisories/CVE-2026-34091/CVSS 5.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 11 May 2026 14:55:33 GMTCVECVE-2026-34088: RecentChanges entries expose suppressed content via generated log page htmlhttps://agentprime.io/advisories/CVE-2026-34088/https://agentprime.io/advisories/CVE-2026-34088/CVSS 1.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 11 May 2026 14:43:44 GMTCVECVE-2025-67481: mw.message(…).parse() doesn't output safe HTML, but it's being used as if it doeshttps://agentprime.io/advisories/CVE-2025-67481/https://agentprime.io/advisories/CVE-2025-67481/CVSS 0.0 (None). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Feb 2026 01:30:39 GMTCVECVE-2025-67483: Theoretical i18n XSS in mediawiki.page.preview.js when a page has multiple protection levelshttps://agentprime.io/advisories/CVE-2025-67483/https://agentprime.io/advisories/CVE-2025-67483/CVSS 0.0 (None). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Feb 2026 01:26:27 GMTCVECVE-2025-67484: Action API xslt option allows JavaScript execution by administrators who are not interface administratorshttps://agentprime.io/advisories/CVE-2025-67484/https://agentprime.io/advisories/CVE-2025-67484/CVSS 0.0 (None). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Feb 2026 01:24:56 GMTCVECVE-2025-67480: list=allrevisions can be used to bypass Extension:Lockdownhttps://agentprime.io/advisories/CVE-2025-67480/https://agentprime.io/advisories/CVE-2025-67480/CVSS 0.0 (None). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Feb 2026 01:23:01 GMTCVECVE-2025-67475: Stored XSS through edit summaries in MW Corehttps://agentprime.io/advisories/CVE-2025-67475/https://agentprime.io/advisories/CVE-2025-67475/CVSS 0.0 (None). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Feb 2026 01:21:09 GMTCVECVE-2025-67476: Importing leaks IP address of importer via EventStreamshttps://agentprime.io/advisories/CVE-2025-67476/https://agentprime.io/advisories/CVE-2025-67476/CVSS 1.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Feb 2026 01:18:55 GMTCVECVE-2025-67477: Stored XSS through a system message in Special:ApiSandboxhttps://agentprime.io/advisories/CVE-2025-67477/https://agentprime.io/advisories/CVE-2025-67477/CVSS 0.0 (None). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Feb 2026 01:16:40 GMTCVECVE-2025-67479: Magic word replacement in legacy parser allows using reserved data attributes through wikitexthttps://agentprime.io/advisories/CVE-2025-67479/https://agentprime.io/advisories/CVE-2025-67479/CVSS 0.0 (None). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Feb 2026 01:12:21 GMTCVECVE-2025-11261: Stored i18n XSS exposed by security patch for T402077https://agentprime.io/advisories/CVE-2025-11261/https://agentprime.io/advisories/CVE-2025-11261/CVSS 0.0 (None). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Feb 2026 00:25:00 GMTCVECVE-2025-61645: CodexTablePager has i18n XSShttps://agentprime.io/advisories/CVE-2025-61645/https://agentprime.io/advisories/CVE-2025-61645/CVSS 0.0 (None). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Feb 2026 00:13:23 GMTCVECVE-2025-61646: Watchlist group mode reveals authors of edits with hidden authorshiphttps://agentprime.io/advisories/CVE-2025-61646/https://agentprime.io/advisories/CVE-2025-61646/CVSS 1.2 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Feb 2026 00:11:28 GMTCVECVE-2025-61644: i18n XSS through Special:Watchlisthttps://agentprime.io/advisories/CVE-2025-61644/https://agentprime.io/advisories/CVE-2025-61644/CVSS 0.0 (None). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Feb 2026 23:57:17 GMTCVECVE-2025-61637: Stored XSS through system messages in MW Corehttps://agentprime.io/advisories/CVE-2025-61637/https://agentprime.io/advisories/CVE-2025-61637/CVSS 0.0 (None). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Feb 2026 23:54:04 GMTCVECVE-2025-61638: Sanitizer::validateAttributes data-XSShttps://agentprime.io/advisories/CVE-2025-61638/https://agentprime.io/advisories/CVE-2025-61638/CVSS 0.0 (None). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Feb 2026 23:52:10 GMTCVECVE-2025-61639: Suppressed blocked IP is visible in Special:BlockList, RC, and other placeshttps://agentprime.io/advisories/CVE-2025-61639/https://agentprime.io/advisories/CVE-2025-61639/CVSS 1.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Feb 2026 23:48:02 GMTCVECVE-2025-61640: Stored XSS through system messages in Special:RecentChangesLinked (MW Core)https://agentprime.io/advisories/CVE-2025-61640/https://agentprime.io/advisories/CVE-2025-61640/CVSS 0.0 (None). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Feb 2026 23:42:03 GMTCVECVE-2025-61641: API list=allpages with maxsize is making really slow querieshttps://agentprime.io/advisories/CVE-2025-61641/https://agentprime.io/advisories/CVE-2025-61641/CVSS 1.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Feb 2026 23:39:38 GMTCVECVE-2025-61642: Stored XSS through system messages provided to CodexHtmlFormshttps://agentprime.io/advisories/CVE-2025-61642/https://agentprime.io/advisories/CVE-2025-61642/CVSS 0.0 (None). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Feb 2026 23:36:42 GMTCVECVE-2025-61643: EventStreams publishes suppressed recent change entries that are suppressed from their creationhttps://agentprime.io/advisories/CVE-2025-61643/https://agentprime.io/advisories/CVE-2025-61643/CVSS 2.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Feb 2026 23:33:50 GMTCVECVE-2025-61634: HTML rest endpoint needs PoolCounter and proper parser cache checkhttps://agentprime.io/advisories/CVE-2025-61634/https://agentprime.io/advisories/CVE-2025-61634/CVSS 0.0 (None). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Feb 2026 23:28:53 GMTCVECVE-2025-61636: Codex Special:Block vulnerable to message key XSShttps://agentprime.io/advisories/CVE-2025-61636/https://agentprime.io/advisories/CVE-2025-61636/CVSS 0.0 (None). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Feb 2026 23:23:27 GMTCVECVE-2025-6589: With MultiBlocks enabled and a user who is suppressed via a MultiBlock, a user without 'hideuser' can see the hidden username in the BlockListhttps://agentprime.io/advisories/CVE-2025-6589/https://agentprime.io/advisories/CVE-2025-6589/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Feb 2026 23:03:45 GMTCVECVE-2025-6590: Complete content leak of private wikis due to PasswordReset Wikitext injection in error messagehttps://agentprime.io/advisories/CVE-2025-6590/https://agentprime.io/advisories/CVE-2025-6590/CVSS 4.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Feb 2026 23:03:07 GMTCVECVE-2025-6591: HTML injection in API action=feedcontributions output from i18n messagehttps://agentprime.io/advisories/CVE-2025-6591/https://agentprime.io/advisories/CVE-2025-6591/CVSS 0.0 (None). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Feb 2026 23:02:33 GMTCVECVE-2025-6593: "{{SITENAME}} registered email address has been changed" email sent to unverified email addresseshttps://agentprime.io/advisories/CVE-2025-6593/https://agentprime.io/advisories/CVE-2025-6593/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Feb 2026 23:01:28 GMTCVECVE-2025-6594: XSS in Special:ApiSandboxhttps://agentprime.io/advisories/CVE-2025-6594/https://agentprime.io/advisories/CVE-2025-6594/CVSS 0.0 (None). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Feb 2026 23:00:57 GMTCVECVE-2025-6597: MediaWiki should not consider autocreation as login for the purposes of security reauthenticationhttps://agentprime.io/advisories/CVE-2025-6597/https://agentprime.io/advisories/CVE-2025-6597/CVSS 0.0 (None). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Feb 2026 22:57:30 GMTCVECVE-2025-6927: Autoblocks from global account suppressions are publicly visiblehttps://agentprime.io/advisories/CVE-2025-6927/https://agentprime.io/advisories/CVE-2025-6927/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Feb 2026 22:55:09 GMTCVECVE-2025-32700: AbuseFilter log interfaces expose global private and hidden filters when central DB is not availablehttps://agentprime.io/advisories/CVE-2025-32700/https://agentprime.io/advisories/CVE-2025-32700/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Thu, 10 Apr 2025 18:31:03 GMTCVECVE-2025-32699: Potential javascript injection attack enabled by Unicode normalization in Action APIhttps://agentprime.io/advisories/CVE-2025-32699/https://agentprime.io/advisories/CVE-2025-32699/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Thu, 10 Apr 2025 18:30:24 GMTCVECVE-2025-32698: LogPager.php: Restriction enforcer functions do not correctly enforce suppression restrictionshttps://agentprime.io/advisories/CVE-2025-32698/https://agentprime.io/advisories/CVE-2025-32698/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Thu, 10 Apr 2025 18:29:52 GMTCVECVE-2025-32697: Cascading protection is not preventing file reversionshttps://agentprime.io/advisories/CVE-2025-32697/https://agentprime.io/advisories/CVE-2025-32697/CVSS 0.0 (None). Published by the CVE Program. Not analysed by agentprime yet.Thu, 10 Apr 2025 18:29:17 GMTCVECVE-2025-32696: "reupload-own" restriction can be bypassed by reverting filehttps://agentprime.io/advisories/CVE-2025-32696/https://agentprime.io/advisories/CVE-2025-32696/CVSS 0.0 (None). Published by the CVE Program. Not analysed by agentprime yet.Thu, 10 Apr 2025 18:28:48 GMTCVE