# Wikimedia Foundation vulnerabilities Source: https://junglewise.ai/threats/vendors/wikimedia-foundation Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/wikimedia-foundation.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 77 vulnerabilities in Wikimedia Foundation: 0 in the last 7 days and 35 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-103585, was published on 30 September 2026. Nothing in the last four weeks, down from 35 vulnerabilities in the four before. 4 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 35 - All time: 77 (0 critical, 0 exploited in the wild) ## About Wikimedia Foundation The Wikimedia Foundation is a non-profit organization that operates Wikipedia and other wiki projects. ## Latest Wikimedia Foundation vulnerabilities - [CVE-2026-103585: Wikimedia MediaSearch XSS vulnerability in HTML tag handling](https://junglewise.ai/threats/cve-2026-103585-improper-neutralization-of-script-related-html-tags-in-a-web) (info, published 30 Sep 2026) - [CVE-2026-103584: MediaWiki CommonsMetadata extension cross-site scripting](https://junglewise.ai/threats/cve-2026-103584-improper-neutralization-of-script-related-html-tags-in-a-web) (info, published 30 Sep 2026) - [CVE-2026-103446: MediaWiki WikiLambda authorization bypass in abstract fragment execution](https://junglewise.ai/threats/cve-2026-103446-authorization-bypass-through-user-controlled-key-vulnerability) (info, published 30 Sep 2026) - [CVE-2026-103445: MediaWiki Page Forms stored cross-site scripting in autoedit redirect](https://junglewise.ai/threats/cve-2026-103445-improper-neutralization-of-script-related-html-tags-in-a-web) (info, published 30 Sep 2026) - [CVE-2026-103439: Wikimedia MediaWiki Wikbase cross-site scripting in HTML tags](https://junglewise.ai/threats/cve-2026-103439-improper-neutralization-of-script-related-html-tags-in-a-web) (info, published 30 Sep 2026) - [CVE-2026-103438: MediaWiki Wikistories XSS in HTML tag sanitization](https://junglewise.ai/threats/cve-2026-103438-improper-neutralization-of-script-related-html-tags-in-a-web) (info, published 30 Sep 2026) - [CVE-2026-103437: MediaWiki ReadingLists reflected XSS in imported URLs](https://junglewise.ai/threats/cve-2026-103437-improper-neutralization-of-script-related-html-tags-in-a-web) (info, published 30 Sep 2026) - [CVE-2026-103444: Wikimedia MediaWiki WikiForum stored XSS in system messages](https://junglewise.ai/threats/cve-2026-103444-improper-neutralization-of-script-related-html-tags-in-a-web) (info, published 30 Sep 2026) - [CVE-2026-103443: MediaWiki Collection extension XSS via crafted javascript URL](https://junglewise.ai/threats/cve-2026-103443-improper-neutralization-of-script-related-html-tags-in-a-web) (info, published 30 Sep 2026) - [CVE-2026-103051: Mediawiki CentralNotice stored cross-site scripting](https://junglewise.ai/threats/cve-2026-103051-improper-neutralization-of-input-during-web-page-generation) (info, published 30 Sep 2026) - [CVE-2026-103050: Mediawiki MassMessage extension stored cross-site scripting](https://junglewise.ai/threats/cve-2026-103050-improper-neutralization-of-input-during-web-page-generation) (info, published 30 Sep 2026) - [CVE-2026-103049: Wikimedia MediaWiki Cargo reflected cross-site scripting](https://junglewise.ai/threats/cve-2026-103049-improper-neutralization-of-input-during-web-page-generation) (info, published 30 Sep 2026) - [CVE-2026-103047: Wikimedia MediaWiki CentralAuth stored cross-site scripting](https://junglewise.ai/threats/cve-2026-103047-improper-neutralization-of-input-during-web-page-generation) (info, published 29 Sep 2026) - [CVE-2026-103046: Wikimedia MediaWiki WikiLambda stored cross-site scripting](https://junglewise.ai/threats/cve-2026-103046-improper-neutralization-of-input-during-web-page-generation) (info, published 29 Sep 2026) - [CVE-2026-103045: MediaWiki Refreshed skin stored cross-site scripting](https://junglewise.ai/threats/cve-2026-103045-improper-neutralization-of-input-during-web-page-generation) (info, published 29 Sep 2026) - [CVE-2026-103044: MediaWiki EasyTimeline XML injection vulnerability](https://junglewise.ai/threats/cve-2026-103044-xml-injection-aka-blind-xpath-injection-vulnerability-in-the) (info, published 29 Sep 2026) - [CVE-2026-102796: Wikimedia MediaWiki UserPageViewTracker SQL injection](https://junglewise.ai/threats/cve-2026-102796-improper-neutralization-of-special-elements-used-in-an-sql) (info, published 29 Sep 2026) - [CVE-2026-100245: Mediawiki Wikibase Extension stored cross-site scripting](https://junglewise.ai/threats/cve-2026-100245-improper-neutralization-of-input-during-web-page-generation-xss) (info, published 29 Sep 2026) - [CVE-2026-100244: MediaWiki CentralAuth Extension sensitive information exposure](https://junglewise.ai/threats/cve-2026-100244-exposure-of-sensitive-information-to-an-unauthorized-actor) (info, published 29 Sep 2026) - [CVE-2026-100243: Wikimedia Foundation MediaWiki WikiSEO Extension stored cross-site scripting](https://junglewise.ai/threats/cve-2026-100243-improper-neutralization-of-input-during-web-page-generation-xss) (info, published 29 Sep 2026) - [CVE-2026-100242: MediaWiki DataTransfer Extension uncontrolled resource consumption](https://junglewise.ai/threats/cve-2026-100242-dependency-on-vulnerable-third-party-component-and-uncontrolled) (info, published 29 Sep 2026) - [CVE-2026-100241: Wikimedia MediaWiki EventBus extension information disclosure](https://junglewise.ai/threats/cve-2026-100241-exposure-of-sensitive-information-to-an-unauthorized-actor) (info, published 29 Sep 2026) - [CVE-2026-100240: Mediawiki TemplateSandbox Extension authorization bypass](https://junglewise.ai/threats/cve-2026-100240-missing-authorization-vulnerability-in-wikimedia-foundation) (info, published 29 Sep 2026) - [CVE-2026-100238: Wikimedia Mediawiki Flow Extension stored XSS](https://junglewise.ai/threats/cve-2026-100238-improper-neutralization-of-input-during-web-page-generation-xss) (info, published 29 Sep 2026) - [CVE-2026-100383: Mediawiki WikiLambda extension stored XSS in Visual Editor integration](https://junglewise.ai/threats/cve-2026-100383-improper-neutralization-of-input-during-web-page-generation-xss) (info, published 25 Sep 2026) ## Most severe Wikimedia Foundation vulnerabilities - [CVE-2026-34089: Vulnerability in Wikimedia Foundation Scribunto. This issue affects Scribunto: from 1.45.0 before 1.45.2.](https://junglewise.ai/threats/cve-2026-34089-wikimedia-foundation-scribunto-memory-leak-in) (high, CVSS 7.5, published 11 May 2026) - [CVE-2026-34092: Wikimedia Foundation MediaWiki information disclosure in Skin.php](https://junglewise.ai/threats/cve-2026-34092-wikimedia-foundation-mediawiki-information-disclosure-in-skin-php) (high, CVSS 7.5, published 11 May 2026) - [CVE-2026-34091: Wikimedia Foundation MediaWiki sensitive information disclosure](https://junglewise.ai/threats/cve-2026-34091-wikimedia-foundation-mediawiki-sensitive-information-disclosure) (high, CVSS 7.5, published 11 May 2026) - [CVE-2026-34090: Wikimedia Foundation CheckUser information exposure in Suggested Investigations](https://junglewise.ai/threats/cve-2026-34090-wikimedia-foundation-checkuser-information-exposure-in-suggested) (high, CVSS 7.5, published 11 May 2026) - [CVE-2026-34088: Wikimedia Foundation MediaWiki sensitive information exposure](https://junglewise.ai/threats/cve-2026-34088-wikimedia-foundation-mediawiki-sensitive-information-exposure) (high, CVSS 7.5, published 11 May 2026) - [CVE-2026-34087: Wikimedia Foundation OATHAuth sensitive information exposure](https://junglewise.ai/threats/cve-2026-34087-wikimedia-foundation-oathauth-sensitive-information-exposure) (high, CVSS 7.5, published 11 May 2026) - [CVE-2026-39839: Wikimedia MediaWiki Cargo Extension stored XSS in map format](https://junglewise.ai/threats/cve-2026-39839-wikimedia-mediawiki-cargo-extension-stored-xss-in-map-format) (medium, CVSS 6.1, published 7 Apr 2026) - [CVE-2026-39841: Wikimedia MediaWiki Cargo Extension stored XSS in list fields](https://junglewise.ai/threats/cve-2026-39841-wikimedia-mediawiki-cargo-extension-stored-xss-in-list-fields) (medium, CVSS 6.1, published 7 Apr 2026) - [CVE-2026-100237: Wikimedia Foundation Mediawiki Thanks Extension stored XSS](https://junglewise.ai/threats/cve-2026-100237-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.1, published 25 Sep 2026) - [CVE-2026-34095: Wikimedia Foundation MediaWiki incorrect Content-Type in ActionEntryPoint](https://junglewise.ai/threats/cve-2026-34095-wikimedia-foundation-mediawiki-incorrect-content-type-in) (medium, CVSS 6.1, published 11 May 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 35 vulnerabilities in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 11 | 0 | 0 | | 28 Sep 2026 | 24 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Wikimedia Foundation technologies - [Wikimedia Foundation Mediawiki](https://junglewise.ai/threats/technologies/mediawiki): 21 vulnerabilities - [Wikimedia Foundation Cargo Extension](https://junglewise.ai/threats/technologies/cargo-extension): 4 vulnerabilities - [Wikimedia Foundation Mediawiki WikiLambda extension](https://junglewise.ai/threats/technologies/mediawiki-wikilambda-extension): 4 vulnerabilities - [Wikimedia Foundation CheckUser](https://junglewise.ai/threats/technologies/checkuser): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Wikimedia Foundation vulnerabilities", https://junglewise.ai/threats/vendors/wikimedia-foundation, 9 November 2026.