WI
Vendor
Wikimedia
21
CVEs
0
On KEV
0
New 30D
Products
ME9.8
Mediawiki-cargo
Wikimedia
3 CVEs0 on KEV0 new
WQ6.1
Wikidata Query Gui
Wikimedia
3 CVEs0 on KEV0 new
ME8.2
Mediawiki-extensions-css
Wikimedia
2 CVEs0 on KEV0 new
PA6.1
Parsoid
Wikimedia
2 CVEs0 on KEV0 new
WI8.2
Wikimedia-extensions-css
Wikimedia
2 CVEs0 on KEV0 new
AN6.1
Analytics-quarry-web
Wikimedia
1 CVEs0 on KEV0 new
AP4.8
Apex
Wikimedia
1 CVEs0 on KEV0 new
CA5.3
Campaignevents
Wikimedia
1 CVEs0 on KEV0 new
MS4.8
Mediawiki-apex Skin
Wikimedia
1 CVEs0 on KEV0 new
ME6.1
mediawiki-extensions-I18nTags
Wikimedia
1 CVEs0 on KEV0 new
ME6.1
Mediawiki-extensions-uploadwizard
Wikimedia
1 CVEs0 on KEV0 new
PA6.9
Pagetriage
Wikimedia
1 CVEs0 on KEV0 new
SC7.5
Scribunto
Wikimedia
1 CVEs0 on KEV0 new
WI5.4
Wikibase
Wikimedia
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-34089 | SC Scribunto Wikimedia | 7.5 | May 11 | Memory leak in Scribunto causes runJobs.php to run out of memory |
| CVE-2025-61638 | PA Parsoid Wikimedia | 4.8 | Feb 2 | Sanitizer::validateAttributes data-XSS |
| CVE-2026-0817 | CA Campaignevents Wikimedia | 5.3 | Jan 9 | CampaignEvents API missing authorization exposes meeting and chat URLs |
| CVE-2026-22710 | WI Wikibase Wikimedia | 5.4 | Jan 8 | Stored XSS through autocomment system messages in Wikibase |
| CVE-2026-0671 | ME Mediawiki-extensions-uploadwizard Wikimedia | 6.1 | Jan 8 | Multiple stored i18n/message-key XSSes in UploadWizard |
| CVE-2024-47841 | WI Wikimedia-extensions-css Wikimedia | 7.5 | Oct 5 | Path traversal when loading stylesheets |
| CVE-2024-47840 | AP Apex Wikimedia | 4.8 | Oct 5 | Stored XSS through sidebar in Apex skin |
| CVE-2024-47847 | ME Mediawiki-cargo Wikimedia | 6.1 | Oct 5 | Various XSSes found in Cargo |
| CVE-2024-47846 | ME Mediawiki-cargo Wikimedia | 8.8 | Oct 5 | Special:DeleteCargoTable and Special:SwitchCargoTable have no CSRF protection |
| CVE-2024-47849 | ME Mediawiki-cargo Wikimedia | 9.8 | Oct 5 | Backticks can allow the usage of not-allowed SQL functions |
| CVE-2024-47845 | WI Wikimedia-extensions-css Wikimedia | 8.2 | Oct 5 | CSS sanitizer used incorrectly, and is easily bypassed |
| CVE-2024-47848 | PA Pagetriage Wikimedia | 6.9 | Oct 4 | User can review/unreview articles while blocked |
| CVE-2018-25065 | ME mediawiki-extensions-I18nTags Wikimedia | 6.1 | Jan 5 | Wikimedia mediawiki-extensions-I18nTags Unlike Parser I18nTags_body.php cross site scripting |
| CVE-2020-36324 | AN Analytics-quarry-web Wikimedia | 6.1 | Apr 21 | Wikimedia Quarry analytics-quarry-web before 2020-12-15 allows Reflected XSS because app.py does not explicitly set the application/json content type |
| CVE-2021-30458 | PA Parsoid Wikimedia | 6.1 | Apr 9 | An issue was discovered in Wikimedia Parsoid before 0.11.1 and 0.12.x before 0.12.2 |
| CVE-2019-19329 | WQ Wikidata Query Gui Wikimedia | 6.1 | Nov 27 | In Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07, when mathematical expressions in results are displayed directly, arbitrary JavaScript execution can occur,… |
| CVE-2019-19328 | WQ Wikidata Query Gui Wikimedia | 6.1 | Nov 27 | ui/editor/tooltip/Rdf.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection in tooltips for entities |
| CVE-2019-19327 | WQ Wikidata Query Gui Wikimedia | 6.1 | Nov 27 | ui/ResultView.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection when reporting the number of results and number of milliseconds |