Skip to content
OpenAdvisories

Vendor

The Wikimedia Foundation

98 known vulnerabilities.

Products

Mediawiki - Cargo extension 11 MediaWiki WikiLambda extension 5 MediaWiki CentralAuth extension 4 Mediawiki - GrowthExperiments Extension 4 Mediawiki - Cargo 3 Mediawiki - Wikilove Extension 2 MediaWiki PageTriage extension 2 Mediawiki - CSS Extension 2 MediaWiki Wikibase extension 2 Mediawiki - CirrusSearch Extension 2 Mediawiki - AdvancedSearch Extension 1 MediaWiki WebAuthn extension 1 MediaWiki QuizGame extension 1 MediaWiki GlobalBlocking extension 1 Mediawiki - UploadWizard Extension 1 Mediawiki - RedirectManager Extension 1 Mediawiki - DiscussionTools Extension 1 Mediawiki - GlobalWatchlist Extension 1 Mediawiki - Score Extension 1 MediaWiki PageForms extension 1 MediaWiki WikiForum extension 1 MediaWiki Wikistories extension 1 Mediawiki - Tabs Extension 1 Mediawiki - Apex skin 1 Mediawiki - AJAX Poll Extension 1 Mediawiki - Mobile Frontend Extension 1 Mediawiki - MultiBoilerplate Extensionmaste 1 Mediawiki - Extension:SimpleCalendar 1 Mediawiki - FlexDiagrams Extension 1 MediaWiki ReadingLists extension 1 Mediawiki - EasyTimeline extension 1 Mediawiki - CentralNotice extension 1 Mediawiki - ImageRating Extension 1 Mediawiki - GrowthExperiments 1 Mediawiki - Wikistories 1 Mediawiki - Visual Data Extension 1 Mediawiki - Growth Experiments Extension 1 MediaWiki PollNY extension 1 Mediawiki - Refreshed skin 1 MediaWiki MediaSearch extension 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.4
    CVE-2026-103446 Public exploit

    WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments

    Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass. This issue affects MediaWiki WikiLambda extension: 1.46.

    The Wikimedia Foundation MediaWiki WikiLambda extension Web / CMS
  • High 7.2
    CVE-2026-103442 Public exploit

    MergeAccount PHP object injection via session-key substitution

    External control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection. This issue affects MediaWiki CentralAuth extension: 1.46, 1.45, and 1.43.

    The Wikimedia Foundation MediaWiki CentralAuth extension Web / CMS
  • High 7.2
    CVE-2026-103441 Public exploit

    Unauthenticated arbitrary file deletion through Wikibase serialized entity parsing

    Deserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in Non-Executable Files. This issue affects MediaWiki Wikibase extension: 1.46, 1.45, and 1.43.

    The Wikimedia Foundation MediaWiki Wikibase extension Web / CMS