{"schema_version":1,"title":"Wikimedia Foundation vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 53 vulnerabilities in Wikimedia Foundation: 11 in the last 7 days and 32 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-100383, was published on 25 September 2026. 3 technologies have a page of their own.","url":"https://junglewise.ai/threats/vendors/wikimedia-foundation","json_url":"https://junglewise.ai/threats/vendors/wikimedia-foundation.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/wikimedia-foundation","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":6,"all_time":53,"critical":0,"exploited":0,"last_7_days":11,"last_30_days":11,"last_90_days":32,"last_365_days":53},"latest":[{"cve":"CVE-2026-100383","slug":"cve-2026-100383-improper-neutralization-of-input-during-web-page-generation-xss","title":"Mediawiki WikiLambda extension stored XSS in Visual Editor integration","severity":"info","exploited":false,"published_at":"2026-09-25T22:17:10.303+00:00","url":"https://junglewise.ai/threats/cve-2026-100383-improper-neutralization-of-input-during-web-page-generation-xss"},{"cve":"CVE-2026-100382","slug":"cve-2026-100382-improper-neutralization-of-special-elements-used-in-an-os","title":"Wikimedia MediaWiki ExternalData extension OS command injection","severity":"info","exploited":false,"published_at":"2026-09-25T22:17:10.15+00:00","url":"https://junglewise.ai/threats/cve-2026-100382-improper-neutralization-of-special-elements-used-in-an-os"},{"cve":"CVE-2026-100381","slug":"cve-2026-100381-improper-neutralization-of-input-during-web-page-generation-xss","title":"Wikimedia Mediawiki UploadWizard DOM XSS in Flickr titles","severity":"info","exploited":false,"published_at":"2026-09-25T22:17:09.027+00:00","url":"https://junglewise.ai/threats/cve-2026-100381-improper-neutralization-of-input-during-web-page-generation-xss"},{"cve":"CVE-2026-96879","slug":"cve-2026-96879-improper-removal-of-sensitive-information-before-storage-or","title":"Wikimedia MediaWiki FlaggedRevs information exposure in storage","severity":"info","exploited":false,"published_at":"2026-09-25T21:17:25.613+00:00","url":"https://junglewise.ai/threats/cve-2026-96879-improper-removal-of-sensitive-information-before-storage-or"},{"cve":"CVE-2026-100380","slug":"cve-2026-100380-improper-neutralization-of-input-during-web-page-generation-xss","title":"MediaWiki Wikibase reflected XSS in Special:SetLabel","severity":"info","exploited":false,"published_at":"2026-09-25T21:17:22.037+00:00","url":"https://junglewise.ai/threats/cve-2026-100380-improper-neutralization-of-input-during-web-page-generation-xss"},{"cve":"CVE-2026-100379","slug":"cve-2026-100379-exposure-of-sensitive-information-to-an-unauthorized-actor","title":"Wikimedia Wikipedia Android App CentralAuth cookie disclosure","severity":"info","exploited":false,"published_at":"2026-09-25T21:17:21.91+00:00","url":"https://junglewise.ai/threats/cve-2026-100379-exposure-of-sensitive-information-to-an-unauthorized-actor"},{"cve":"CVE-2026-100378","slug":"cve-2026-100378-missing-authorization-vulnerability-in-wikimedia-foundation","title":"MediaWiki Translate extension missing authorization in sandbox reminder action","severity":"info","exploited":false,"published_at":"2026-09-25T21:17:21.78+00:00","url":"https://junglewise.ai/threats/cve-2026-100378-missing-authorization-vulnerability-in-wikimedia-foundation"},{"cve":"CVE-2026-100377","slug":"cve-2026-100377-exposure-of-sensitive-information-to-an-unauthorized-actor","title":"MediaWiki WikiLambda information disclosure in revision handling","severity":"info","exploited":false,"published_at":"2026-09-25T21:17:21.65+00:00","url":"https://junglewise.ai/threats/cve-2026-100377-exposure-of-sensitive-information-to-an-unauthorized-actor"},{"cve":"CVE-2026-100376","slug":"cve-2026-100376-improper-neutralization-of-input-during-web-page-generation-xss","title":"MediaWiki TemplateSandbox cross-site scripting via user namespace","severity":"info","exploited":false,"published_at":"2026-09-25T21:17:21.517+00:00","url":"https://junglewise.ai/threats/cve-2026-100376-improper-neutralization-of-input-during-web-page-generation-xss"},{"cve":"CVE-2026-100237","cvss":6.1,"slug":"cve-2026-100237-improper-neutralization-of-input-during-web-page-generation","title":"Wikimedia Foundation Mediawiki Thanks Extension stored XSS","severity":"medium","exploited":false,"published_at":"2026-09-25T17:17:07.127+00:00","url":"https://junglewise.ai/threats/cve-2026-100237-improper-neutralization-of-input-during-web-page-generation"},{"cve":"CVE-2026-96872","epss":0.0023,"slug":"cve-2026-96872-improper-handling-of-insufficient-permissions-or-privileges","title":"Wikimedia MediaWiki WikiLambda privilege escalation","severity":"info","exploited":false,"published_at":"2026-09-23T19:19:55.327+00:00","url":"https://junglewise.ai/threats/cve-2026-96872-improper-handling-of-insufficient-permissions-or-privileges"},{"cve":"CVE-2026-58517","cvss":6.9,"slug":"cve-2026-58517-wikimedia-mediawiki-wikilambda-extension-authentication-bypass","title":"Wikimedia MediaWiki WikiLambda Extension authentication bypass","severity":"info","exploited":false,"published_at":"2026-07-01T19:16:57.063+00:00","url":"https://junglewise.ai/threats/cve-2026-58517-wikimedia-mediawiki-wikilambda-extension-authentication-bypass"},{"cve":"CVE-2026-14358","cvss":6.9,"slug":"cve-2026-14358-wikimedia-mediawiki-charts-extension-stored-xss-in-pie-tooltips","title":"Wikimedia MediaWiki Charts Extension Stored XSS in Pie Tooltips","severity":"info","exploited":false,"published_at":"2026-07-01T19:16:50.073+00:00","url":"https://junglewise.ai/threats/cve-2026-14358-wikimedia-mediawiki-charts-extension-stored-xss-in-pie-tooltips"},{"cve":"CVE-2026-58520","cvss":6.9,"slug":"cve-2026-58520-wikimedia-mediawiki-urlshortener-open-redirect-via-missing-regex","title":"Wikimedia MediaWiki UrlShortener open redirect via missing regex anchors","severity":"info","exploited":false,"published_at":"2026-07-01T18:16:35.983+00:00","url":"https://junglewise.ai/threats/cve-2026-58520-wikimedia-mediawiki-urlshortener-open-redirect-via-missing-regex"},{"cve":"CVE-2026-58037","cvss":0,"slug":"cve-2026-58037-wikimedia-foundation-mediawiki-xss-in-logging-and-special-pages","title":"Wikimedia Foundation MediaWiki XSS in Logging and Special Pages","severity":"info","exploited":false,"published_at":"2026-07-01T16:16:51.063+00:00","url":"https://junglewise.ai/threats/cve-2026-58037-wikimedia-foundation-mediawiki-xss-in-logging-and-special-pages"},{"cve":"CVE-2026-58036","cvss":2.1,"slug":"cve-2026-58036-wikimedia-foundation-mediawiki-information-exposure-in-user-api","title":"Wikimedia Foundation MediaWiki Information Exposure in User API","severity":"info","exploited":false,"published_at":"2026-07-01T16:16:50.95+00:00","url":"https://junglewise.ai/threats/cve-2026-58036-wikimedia-foundation-mediawiki-information-exposure-in-user-api"},{"cve":"CVE-2026-58033","cvss":5.3,"slug":"cve-2026-58033-wikimedia-foundation-mediawiki-information-disclosure-in","title":"Wikimedia Foundation MediaWiki information disclosure in InfoAction","severity":"info","exploited":false,"published_at":"2026-07-01T16:16:50.627+00:00","url":"https://junglewise.ai/threats/cve-2026-58033-wikimedia-foundation-mediawiki-information-disclosure-in"},{"cve":"CVE-2026-58032","cvss":5.3,"slug":"cve-2026-58032-wikimedia-foundation-mediawiki-xss-in-mediawiki-api-component","title":"Wikimedia Foundation MediaWiki XSS in mediawiki.Api component","severity":"info","exploited":false,"published_at":"2026-07-01T16:16:50.52+00:00","url":"https://junglewise.ai/threats/cve-2026-58032-wikimedia-foundation-mediawiki-xss-in-mediawiki-api-component"},{"cve":"CVE-2026-58030","cvss":5.3,"slug":"cve-2026-58030-wikimedia-foundation-syntaxhighlight-geshi-xss-in-syntaxhighlight","title":"Wikimedia Foundation SyntaxHighlight_GeSHi XSS in SyntaxHighlight.php","severity":"info","exploited":false,"published_at":"2026-07-01T16:16:50.31+00:00","url":"https://junglewise.ai/threats/cve-2026-58030-wikimedia-foundation-syntaxhighlight-geshi-xss-in-syntaxhighlight"},{"cve":"CVE-2026-58029","cvss":5.3,"slug":"cve-2026-58029-wikimedia-foundation-mediawiki-improper-authentication-in-account","title":"Wikimedia Foundation MediaWiki improper authentication in account management components","severity":"info","exploited":false,"published_at":"2026-07-01T16:16:50.197+00:00","url":"https://junglewise.ai/threats/cve-2026-58029-wikimedia-foundation-mediawiki-improper-authentication-in-account"},{"cve":"CVE-2026-58028","cvss":0,"slug":"cve-2026-58028-wikimedia-foundation-mediawiki-and-centralauth-xss","title":"Wikimedia Foundation MediaWiki and CentralAuth XSS","severity":"info","exploited":false,"published_at":"2026-07-01T16:16:50.077+00:00","url":"https://junglewise.ai/threats/cve-2026-58028-wikimedia-foundation-mediawiki-and-centralauth-xss"},{"cve":"CVE-2026-58027","cvss":5.3,"slug":"cve-2026-58027-wikimedia-foundation-abusefilter-information-disclosure-in","title":"Wikimedia Foundation AbuseFilter information disclosure in QueryAbuseFilters","severity":"info","exploited":false,"published_at":"2026-07-01T16:16:49.947+00:00","url":"https://junglewise.ai/threats/cve-2026-58027-wikimedia-foundation-abusefilter-information-disclosure-in"},{"cve":"CVE-2026-58026","cvss":0,"slug":"cve-2026-58026-wikimedia-foundation-mediawiki-information-disclosure-in-parser","title":"Wikimedia Foundation MediaWiki information disclosure in Parser.php","severity":"info","exploited":false,"published_at":"2026-07-01T16:16:49.82+00:00","url":"https://junglewise.ai/threats/cve-2026-58026-wikimedia-foundation-mediawiki-information-disclosure-in-parser"},{"cve":"CVE-2026-58025","cvss":5.9,"slug":"cve-2026-58025-wikimedia-foundation-mediawiki-deserialization-in-wikiimporter","title":"Wikimedia Foundation MediaWiki deserialization in WikiImporter","severity":"info","exploited":false,"published_at":"2026-07-01T16:16:49.703+00:00","url":"https://junglewise.ai/threats/cve-2026-58025-wikimedia-foundation-mediawiki-deserialization-in-wikiimporter"},{"cve":"CVE-2026-58024","cvss":5.1,"slug":"cve-2026-58024-wikimedia-foundation-mediawiki-information-disclosure-in","title":"Wikimedia Foundation MediaWiki information disclosure in ApiUserrights","severity":"info","exploited":false,"published_at":"2026-07-01T16:16:49.583+00:00","url":"https://junglewise.ai/threats/cve-2026-58024-wikimedia-foundation-mediawiki-information-disclosure-in"}],"vendor":{"hub":true,"name":"Wikimedia Foundation","slug":"wikimedia-foundation","homepage":"https://wikimediafoundation.org/","description":"The Wikimedia Foundation is a non-profit organization that operates Wikipedia and other wiki projects.","url":"https://junglewise.ai/threats/vendors/wikimedia-foundation"},"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":21},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":11}],"most_severe":[{"cve":"CVE-2026-34089","cvss":7.5,"epss":0.0043,"slug":"cve-2026-34089-wikimedia-foundation-scribunto-memory-leak-in","title":"Vulnerability in Wikimedia Foundation Scribunto. This issue affects Scribunto: from 1.45.0 before 1.45.2.","severity":"high","exploited":false,"published_at":"2026-05-11T16:17:30.293+00:00","url":"https://junglewise.ai/threats/cve-2026-34089-wikimedia-foundation-scribunto-memory-leak-in"},{"cve":"CVE-2026-34092","cvss":7.5,"slug":"cve-2026-34092-wikimedia-foundation-mediawiki-information-disclosure-in-skin-php","title":"Wikimedia Foundation MediaWiki information disclosure in Skin.php","severity":"high","exploited":false,"published_at":"2026-05-11T16:17:30.663+00:00","url":"https://junglewise.ai/threats/cve-2026-34092-wikimedia-foundation-mediawiki-information-disclosure-in-skin-php"},{"cve":"CVE-2026-34091","cvss":7.5,"slug":"cve-2026-34091-wikimedia-foundation-mediawiki-sensitive-information-disclosure","title":"Wikimedia Foundation MediaWiki sensitive information disclosure","severity":"high","exploited":false,"published_at":"2026-05-11T16:17:30.537+00:00","url":"https://junglewise.ai/threats/cve-2026-34091-wikimedia-foundation-mediawiki-sensitive-information-disclosure"},{"cve":"CVE-2026-34090","cvss":7.5,"slug":"cve-2026-34090-wikimedia-foundation-checkuser-information-exposure-in-suggested","title":"Wikimedia Foundation CheckUser information exposure in Suggested Investigations","severity":"high","exploited":false,"published_at":"2026-05-11T16:17:30.407+00:00","url":"https://junglewise.ai/threats/cve-2026-34090-wikimedia-foundation-checkuser-information-exposure-in-suggested"},{"cve":"CVE-2026-34088","cvss":7.5,"slug":"cve-2026-34088-wikimedia-foundation-mediawiki-sensitive-information-exposure","title":"Wikimedia Foundation MediaWiki sensitive information exposure","severity":"high","exploited":false,"published_at":"2026-05-11T16:17:30.157+00:00","url":"https://junglewise.ai/threats/cve-2026-34088-wikimedia-foundation-mediawiki-sensitive-information-exposure"},{"cve":"CVE-2026-34087","cvss":7.5,"slug":"cve-2026-34087-wikimedia-foundation-oathauth-sensitive-information-exposure","title":"Wikimedia Foundation OATHAuth sensitive information exposure","severity":"high","exploited":false,"published_at":"2026-05-11T16:17:30.023+00:00","url":"https://junglewise.ai/threats/cve-2026-34087-wikimedia-foundation-oathauth-sensitive-information-exposure"},{"cve":"CVE-2026-39839","cvss":6.1,"epss":0.0018,"slug":"cve-2026-39839-wikimedia-mediawiki-cargo-extension-stored-xss-in-map-format","title":"Wikimedia MediaWiki Cargo Extension stored XSS in map format","severity":"medium","exploited":false,"published_at":"2026-04-07T20:16:33.773+00:00","url":"https://junglewise.ai/threats/cve-2026-39839-wikimedia-mediawiki-cargo-extension-stored-xss-in-map-format"},{"cve":"CVE-2026-39841","cvss":6.1,"epss":0.0016,"slug":"cve-2026-39841-wikimedia-mediawiki-cargo-extension-stored-xss-in-list-fields","title":"Wikimedia MediaWiki Cargo Extension stored XSS in list fields","severity":"medium","exploited":false,"published_at":"2026-04-07T20:16:34.077+00:00","url":"https://junglewise.ai/threats/cve-2026-39841-wikimedia-mediawiki-cargo-extension-stored-xss-in-list-fields"},{"cve":"CVE-2026-100237","cvss":6.1,"slug":"cve-2026-100237-improper-neutralization-of-input-during-web-page-generation","title":"Wikimedia Foundation Mediawiki Thanks Extension stored XSS","severity":"medium","exploited":false,"published_at":"2026-09-25T17:17:07.127+00:00","url":"https://junglewise.ai/threats/cve-2026-100237-improper-neutralization-of-input-during-web-page-generation"},{"cve":"CVE-2026-34095","cvss":6.1,"slug":"cve-2026-34095-wikimedia-foundation-mediawiki-incorrect-content-type-in","title":"Wikimedia Foundation MediaWiki incorrect Content-Type in ActionEntryPoint","severity":"medium","exploited":false,"published_at":"2026-05-11T18:16:32.223+00:00","url":"https://junglewise.ai/threats/cve-2026-34095-wikimedia-foundation-mediawiki-incorrect-content-type-in"}],"generated_at":"2026-09-26T12:07:00.15149+00:00","technologies":[{"name":"Wikimedia Foundation Mediawiki","slug":"mediawiki","vulnerabilities":18,"url":"https://junglewise.ai/threats/technologies/mediawiki"},{"name":"Wikimedia Foundation Cargo Extension","slug":"cargo-extension","vulnerabilities":4,"url":"https://junglewise.ai/threats/technologies/cargo-extension"},{"name":"Wikimedia Foundation CheckUser","slug":"checkuser","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/checkuser"}]}