{"schema_version":1,"title":"Wikimedia Foundation Mediawiki vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 20 vulnerabilities in Wikimedia Foundation Mediawiki: 2 in the last 7 days and 14 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-100381, was published on 25 September 2026.","url":"https://junglewise.ai/threats/technologies/mediawiki","json_url":"https://junglewise.ai/threats/technologies/mediawiki.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/mediawiki","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":3,"all_time":20,"critical":0,"exploited":0,"last_7_days":2,"last_30_days":3,"last_90_days":14,"last_365_days":20},"latest":[{"cve":"CVE-2026-100381","slug":"cve-2026-100381-improper-neutralization-of-input-during-web-page-generation-xss","title":"Wikimedia Mediawiki UploadWizard DOM XSS in Flickr titles","severity":"info","exploited":false,"published_at":"2026-09-25T22:17:09.027+00:00","url":"https://junglewise.ai/threats/cve-2026-100381-improper-neutralization-of-input-during-web-page-generation-xss"},{"cve":"CVE-2026-100380","slug":"cve-2026-100380-improper-neutralization-of-input-during-web-page-generation-xss","title":"MediaWiki Wikibase reflected XSS in Special:SetLabel","severity":"info","exploited":false,"published_at":"2026-09-25T21:17:22.037+00:00","url":"https://junglewise.ai/threats/cve-2026-100380-improper-neutralization-of-input-during-web-page-generation-xss"},{"cve":"CVE-2023-37252","cvss":3.1,"epss":0.0024,"slug":"cve-2023-37252-mediawiki-checkuser-extension-information-disclosure-in-log","title":"MediaWiki CheckUser extension information disclosure in log","severity":"low","exploited":false,"published_at":"2026-09-14T05:16:57.58+00:00","url":"https://junglewise.ai/threats/cve-2023-37252-mediawiki-checkuser-extension-information-disclosure-in-log"},{"cve":"CVE-2026-58037","cvss":0,"slug":"cve-2026-58037-wikimedia-foundation-mediawiki-xss-in-logging-and-special-pages","title":"Wikimedia Foundation MediaWiki XSS in Logging and Special Pages","severity":"info","exploited":false,"published_at":"2026-07-01T16:16:51.063+00:00","url":"https://junglewise.ai/threats/cve-2026-58037-wikimedia-foundation-mediawiki-xss-in-logging-and-special-pages"},{"cve":"CVE-2026-58036","cvss":2.1,"slug":"cve-2026-58036-wikimedia-foundation-mediawiki-information-exposure-in-user-api","title":"Wikimedia Foundation MediaWiki Information Exposure in User API","severity":"info","exploited":false,"published_at":"2026-07-01T16:16:50.95+00:00","url":"https://junglewise.ai/threats/cve-2026-58036-wikimedia-foundation-mediawiki-information-exposure-in-user-api"},{"cve":"CVE-2026-58033","cvss":5.3,"slug":"cve-2026-58033-wikimedia-foundation-mediawiki-information-disclosure-in","title":"Wikimedia Foundation MediaWiki information disclosure in InfoAction","severity":"info","exploited":false,"published_at":"2026-07-01T16:16:50.627+00:00","url":"https://junglewise.ai/threats/cve-2026-58033-wikimedia-foundation-mediawiki-information-disclosure-in"},{"cve":"CVE-2026-58032","cvss":5.3,"slug":"cve-2026-58032-wikimedia-foundation-mediawiki-xss-in-mediawiki-api-component","title":"Wikimedia Foundation MediaWiki XSS in mediawiki.Api component","severity":"info","exploited":false,"published_at":"2026-07-01T16:16:50.52+00:00","url":"https://junglewise.ai/threats/cve-2026-58032-wikimedia-foundation-mediawiki-xss-in-mediawiki-api-component"},{"cve":"CVE-2026-58029","cvss":5.3,"slug":"cve-2026-58029-wikimedia-foundation-mediawiki-improper-authentication-in-account","title":"Wikimedia Foundation MediaWiki improper authentication in account management components","severity":"info","exploited":false,"published_at":"2026-07-01T16:16:50.197+00:00","url":"https://junglewise.ai/threats/cve-2026-58029-wikimedia-foundation-mediawiki-improper-authentication-in-account"},{"cve":"CVE-2026-58028","cvss":0,"slug":"cve-2026-58028-wikimedia-foundation-mediawiki-and-centralauth-xss","title":"Wikimedia Foundation MediaWiki and CentralAuth XSS","severity":"info","exploited":false,"published_at":"2026-07-01T16:16:50.077+00:00","url":"https://junglewise.ai/threats/cve-2026-58028-wikimedia-foundation-mediawiki-and-centralauth-xss"},{"cve":"CVE-2026-58026","cvss":0,"slug":"cve-2026-58026-wikimedia-foundation-mediawiki-information-disclosure-in-parser","title":"Wikimedia Foundation MediaWiki information disclosure in Parser.php","severity":"info","exploited":false,"published_at":"2026-07-01T16:16:49.82+00:00","url":"https://junglewise.ai/threats/cve-2026-58026-wikimedia-foundation-mediawiki-information-disclosure-in-parser"},{"cve":"CVE-2026-58025","cvss":5.9,"slug":"cve-2026-58025-wikimedia-foundation-mediawiki-deserialization-in-wikiimporter","title":"Wikimedia Foundation MediaWiki deserialization in WikiImporter","severity":"info","exploited":false,"published_at":"2026-07-01T16:16:49.703+00:00","url":"https://junglewise.ai/threats/cve-2026-58025-wikimedia-foundation-mediawiki-deserialization-in-wikiimporter"},{"cve":"CVE-2026-58024","cvss":5.1,"slug":"cve-2026-58024-wikimedia-foundation-mediawiki-information-disclosure-in","title":"Wikimedia Foundation MediaWiki information disclosure in ApiUserrights","severity":"info","exploited":false,"published_at":"2026-07-01T16:16:49.583+00:00","url":"https://junglewise.ai/threats/cve-2026-58024-wikimedia-foundation-mediawiki-information-disclosure-in"},{"cve":"CVE-2026-58035","cvss":0,"slug":"cve-2026-58035-wikimedia-foundation-mediawiki-xss-in-specialblock-vue","title":"Wikimedia Foundation MediaWiki XSS in SpecialBlock.Vue","severity":"info","exploited":false,"published_at":"2026-07-01T15:17:11.263+00:00","url":"https://junglewise.ai/threats/cve-2026-58035-wikimedia-foundation-mediawiki-xss-in-specialblock-vue"},{"cve":"CVE-2026-58031","cvss":0,"slug":"cve-2026-58031-wikimedia-foundation-mediawiki-xss-in-apisandboxlayout","title":"Wikimedia Foundation MediaWiki XSS in ApiSandboxLayout","severity":"info","exploited":false,"published_at":"2026-07-01T15:17:11.02+00:00","url":"https://junglewise.ai/threats/cve-2026-58031-wikimedia-foundation-mediawiki-xss-in-apisandboxlayout"},{"cve":"CVE-2026-34095","cvss":6.1,"slug":"cve-2026-34095-wikimedia-foundation-mediawiki-incorrect-content-type-in","title":"Wikimedia Foundation MediaWiki incorrect Content-Type in ActionEntryPoint","severity":"medium","exploited":false,"published_at":"2026-05-11T18:16:32.223+00:00","url":"https://junglewise.ai/threats/cve-2026-34095-wikimedia-foundation-mediawiki-incorrect-content-type-in"},{"cve":"CVE-2026-34094","cvss":3.8,"epss":0.0005,"slug":"cve-2026-34094-wikimedia-foundation-mediawiki-javascript-injection-in-page","title":"Wikimedia Foundation MediaWiki JavaScript injection in page protection indicators","severity":"low","exploited":false,"published_at":"2026-05-11T18:16:32.1+00:00","url":"https://junglewise.ai/threats/cve-2026-34094-wikimedia-foundation-mediawiki-javascript-injection-in-page"},{"cve":"CVE-2026-34093","cvss":5.3,"epss":0.0005,"slug":"cve-2026-34093-wikimedia-foundation-mediawiki-sensitive-information-exposure-in","title":"Wikimedia Foundation MediaWiki sensitive information exposure in SpecialUserRights","severity":"medium","exploited":false,"published_at":"2026-05-11T18:16:31.963+00:00","url":"https://junglewise.ai/threats/cve-2026-34093-wikimedia-foundation-mediawiki-sensitive-information-exposure-in"},{"cve":"CVE-2026-34092","cvss":7.5,"slug":"cve-2026-34092-wikimedia-foundation-mediawiki-information-disclosure-in-skin-php","title":"Wikimedia Foundation MediaWiki information disclosure in Skin.php","severity":"high","exploited":false,"published_at":"2026-05-11T16:17:30.663+00:00","url":"https://junglewise.ai/threats/cve-2026-34092-wikimedia-foundation-mediawiki-information-disclosure-in-skin-php"},{"cve":"CVE-2026-34091","cvss":7.5,"slug":"cve-2026-34091-wikimedia-foundation-mediawiki-sensitive-information-disclosure","title":"Wikimedia Foundation MediaWiki sensitive information disclosure","severity":"high","exploited":false,"published_at":"2026-05-11T16:17:30.537+00:00","url":"https://junglewise.ai/threats/cve-2026-34091-wikimedia-foundation-mediawiki-sensitive-information-disclosure"},{"cve":"CVE-2026-34088","cvss":7.5,"slug":"cve-2026-34088-wikimedia-foundation-mediawiki-sensitive-information-exposure","title":"Wikimedia Foundation MediaWiki sensitive information exposure","severity":"high","exploited":false,"published_at":"2026-05-11T16:17:30.157+00:00","url":"https://junglewise.ai/threats/cve-2026-34088-wikimedia-foundation-mediawiki-sensitive-information-exposure"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":11},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":2}],"related":[{"name":"Wikimedia Foundation Cargo Extension","slug":"cargo-extension","vulnerabilities":4,"url":"https://junglewise.ai/threats/technologies/cargo-extension"},{"name":"Wikimedia Foundation CheckUser","slug":"checkuser","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/checkuser"}],"technology":{"hub":true,"name":"Wikimedia Foundation Mediawiki","slug":"mediawiki","vendor":{"name":"Wikimedia Foundation","slug":"wikimedia-foundation","url":"https://junglewise.ai/threats/vendors/wikimedia-foundation"},"aliases":[],"category":"cms","homepage":"https://www.mediawiki.org/","repo_url":"https://github.com/wikimedia/mediawiki","description":"MediaWiki is a free and open-source wiki software package written in PHP and used by tens of thousands of websites.","url":"https://junglewise.ai/threats/technologies/mediawiki"},"most_severe":[{"cve":"CVE-2026-34092","cvss":7.5,"slug":"cve-2026-34092-wikimedia-foundation-mediawiki-information-disclosure-in-skin-php","title":"Wikimedia Foundation MediaWiki information disclosure in Skin.php","severity":"high","exploited":false,"published_at":"2026-05-11T16:17:30.663+00:00","url":"https://junglewise.ai/threats/cve-2026-34092-wikimedia-foundation-mediawiki-information-disclosure-in-skin-php"},{"cve":"CVE-2026-34091","cvss":7.5,"slug":"cve-2026-34091-wikimedia-foundation-mediawiki-sensitive-information-disclosure","title":"Wikimedia Foundation MediaWiki sensitive information disclosure","severity":"high","exploited":false,"published_at":"2026-05-11T16:17:30.537+00:00","url":"https://junglewise.ai/threats/cve-2026-34091-wikimedia-foundation-mediawiki-sensitive-information-disclosure"},{"cve":"CVE-2026-34088","cvss":7.5,"slug":"cve-2026-34088-wikimedia-foundation-mediawiki-sensitive-information-exposure","title":"Wikimedia Foundation MediaWiki sensitive information exposure","severity":"high","exploited":false,"published_at":"2026-05-11T16:17:30.157+00:00","url":"https://junglewise.ai/threats/cve-2026-34088-wikimedia-foundation-mediawiki-sensitive-information-exposure"},{"cve":"CVE-2026-34095","cvss":6.1,"slug":"cve-2026-34095-wikimedia-foundation-mediawiki-incorrect-content-type-in","title":"Wikimedia Foundation MediaWiki incorrect Content-Type in ActionEntryPoint","severity":"medium","exploited":false,"published_at":"2026-05-11T18:16:32.223+00:00","url":"https://junglewise.ai/threats/cve-2026-34095-wikimedia-foundation-mediawiki-incorrect-content-type-in"},{"cve":"CVE-2026-34093","cvss":5.3,"epss":0.0005,"slug":"cve-2026-34093-wikimedia-foundation-mediawiki-sensitive-information-exposure-in","title":"Wikimedia Foundation MediaWiki sensitive information exposure in SpecialUserRights","severity":"medium","exploited":false,"published_at":"2026-05-11T18:16:31.963+00:00","url":"https://junglewise.ai/threats/cve-2026-34093-wikimedia-foundation-mediawiki-sensitive-information-exposure-in"},{"cve":"CVE-2026-34094","cvss":3.8,"epss":0.0005,"slug":"cve-2026-34094-wikimedia-foundation-mediawiki-javascript-injection-in-page","title":"Wikimedia Foundation MediaWiki JavaScript injection in page protection indicators","severity":"low","exploited":false,"published_at":"2026-05-11T18:16:32.1+00:00","url":"https://junglewise.ai/threats/cve-2026-34094-wikimedia-foundation-mediawiki-javascript-injection-in-page"},{"cve":"CVE-2023-37252","cvss":3.1,"epss":0.0024,"slug":"cve-2023-37252-mediawiki-checkuser-extension-information-disclosure-in-log","title":"MediaWiki CheckUser extension information disclosure in log","severity":"low","exploited":false,"published_at":"2026-09-14T05:16:57.58+00:00","url":"https://junglewise.ai/threats/cve-2023-37252-mediawiki-checkuser-extension-information-disclosure-in-log"},{"cve":"CVE-2026-58025","cvss":5.9,"slug":"cve-2026-58025-wikimedia-foundation-mediawiki-deserialization-in-wikiimporter","title":"Wikimedia Foundation MediaWiki deserialization in WikiImporter","severity":"info","exploited":false,"published_at":"2026-07-01T16:16:49.703+00:00","url":"https://junglewise.ai/threats/cve-2026-58025-wikimedia-foundation-mediawiki-deserialization-in-wikiimporter"},{"cve":"CVE-2026-58033","cvss":5.3,"slug":"cve-2026-58033-wikimedia-foundation-mediawiki-information-disclosure-in","title":"Wikimedia Foundation MediaWiki information disclosure in InfoAction","severity":"info","exploited":false,"published_at":"2026-07-01T16:16:50.627+00:00","url":"https://junglewise.ai/threats/cve-2026-58033-wikimedia-foundation-mediawiki-information-disclosure-in"},{"cve":"CVE-2026-58032","cvss":5.3,"slug":"cve-2026-58032-wikimedia-foundation-mediawiki-xss-in-mediawiki-api-component","title":"Wikimedia Foundation MediaWiki XSS in mediawiki.Api component","severity":"info","exploited":false,"published_at":"2026-07-01T16:16:50.52+00:00","url":"https://junglewise.ai/threats/cve-2026-58032-wikimedia-foundation-mediawiki-xss-in-mediawiki-api-component"}],"generated_at":"2026-09-26T11:07:00.153785+00:00"}