CVE Tools
Track your stack

Wikimedia

3 CVEs tracked since 2019. Since Nov 2019, none of them reached CISA KEV.

Wikimedia CVEs per month

Nov 2019 to Nov 2019. Point at a month, or focus the strip and use the arrow keys.
Wikimedia CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2019-1130

Products

The products that kept showing up in Wikimedia's monthly top three, with their CVEs summed over those months.

  1. Wikidata Query Gui31 month

Latest CVEs

The 13 most recently published vulnerabilities affecting Wikimedia.

  1. CVE-2026-34089Memory leak in Scribunto causes runJobs.php to run out of memory7.5
  2. CVE-2026-0817CampaignEvents API missing authorization exposes meeting and chat URLs5.3
  3. CVE-2026-22710Stored XSS through autocomment system messages in Wikibase5.4
  4. CVE-2026-0671Multiple stored i18n/message-key XSSes in UploadWizard6.1
  5. CVE-2024-47841Path traversal when loading stylesheets7.5
  6. CVE-2024-47840Stored XSS through sidebar in Apex skin4.8
  7. CVE-2024-47845CSS sanitizer used incorrectly, and is easily bypassed8.2
  8. CVE-2018-25065Wikimedia mediawiki-extensions-I18nTags Unlike Parser I18nTags_body.php cross site scripting3.5
  9. CVE-2020-36324Wikimedia Quarry analytics-quarry-web before 2020-12-15 allows Reflected XSS because app.py does not explicitly set the application/json content type.6.1
  10. CVE-2021-30458An issue was discovered in Wikimedia Parsoid before 0.11.1 and 0.12.x before 0.12.2. An attacker can send crafted wikitext that Utils/WTUtils.php will transform by using a <meta> tag, bypassing san...6.1
  11. CVE-2019-19327ui/ResultView.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection when reporting the number of results and number of milliseconds. NOTE: this GUI code i...6.1
  12. CVE-2019-19328ui/editor/tooltip/Rdf.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection in tooltips for entities. NOTE: this GUI code is no longer bundled with the Wi...6.1
  13. CVE-2019-19329In Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07, when mathematical expressions in results are displayed directly, arbitrary JavaScript execution can occur, aka XSS. This was...6.1

The record

Peak rank
#162 in Nov 2019
Busiest month shown
Nov 2019, 3 CVEs
Months with a KEV entry
0 since Nov 2019
Monthly snapshots
1 since 2019
Wikimedia's full record, month by month

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store