PatchTheCVEmediawiki vulnerabilities and fixes
Recent CVEs affecting mediawiki, with upgrade or downgrade steps. 21 tracked.
mediawiki has 21 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 17. Most recent: 2026-07-01. Highest priority: CVE-2026-8857 (score 56/100).
- CVE-2026-8857 HIGH 8.8 UPGRADE A vulnerability in Wikimedia Foundation timeline. This vulnerability is associated with program files script
- CVE-2026-58025 CRITICAL 9.8 UPGRADE Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is ass
- CVE-2026-13706 HIGH 8.8 UPGRADE Improper input validation vulnerability in Wikimedia Foundation UrlShortener. This vulnerability is associat
- CVE-2026-58036 HIGH 7.5 DOWNGRADE Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.
- CVE-2026-58029 MEDIUM 6.5 UPGRADE Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files include
- CVE-2026-13707 HIGH 7.6 UPGRADE Session fixation vulnerability in Wikimedia Foundation OAuth. This vulnerability is associated with program
- CVE-2026-58033 MEDIUM 6.5 UPGRADE Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.
- CVE-2026-58027 MEDIUM 6.5 UPGRADE Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter.
- CVE-2026-58024 MEDIUM 5.7 UPGRADE Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.
- CVE-2026-58026 MEDIUM 5.7 UPGRADE Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.
- CVE-2026-58032 MEDIUM 6.1 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in W
- CVE-2026-58030 MEDIUM 6.1 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in W
- CVE-2026-58037 MEDIUM 6.1 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in W
- CVE-2026-58038 MEDIUM 6.1 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in W
- CVE-2026-58031 MEDIUM 5.4 DOWNGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in W
- CVE-2026-58518 MEDIUM 6.3 UPGRADE Cross-Site request forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - RedirectManager Extens
- CVE-2026-58034 MEDIUM 4.8 DOWNGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in W
- CVE-2026-58035 MEDIUM 4.8 DOWNGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in W
- CVE-2026-14358 MEDIUM 6.1 UPGRADE Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wiki
- CVE-2026-58520 MEDIUM 6.1 UPGRADE URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - UrlS
- CVE-2026-58517 MEDIUM 4.3 UPGRADE Improper neutralization of input terminators vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda
FAQ
How do I fix mediawiki vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is mediawiki being exploited right now?
None of the tracked mediawiki CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which mediawiki CVE should I patch first?
CVE-2026-8857 currently ranks highest (56/100): A vulnerability in Wikimedia Foundation timeline. This vulnerability is associated with program files script.