https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-116892.htmlhttps://patchthecve.com/cve/CVE-2026-116892.htmlWed, 28 Oct 2026 15:33:47 +0000MEDIUM 6.1: SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject markup through the search parameter of the extended Special:Search profile. Attackers can send visitors crafted URLs using the smw profile with SVG event https://patchthecve.com/cve/CVE-2026-116891.htmlhttps://patchthecve.com/cve/CVE-2026-116891.htmlWed, 28 Oct 2026 15:33:38 +0000MEDIUM 6.1: SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject HTML via unescaped cstate parameters in Special:FacetedSearch. Attackers can craft URLs with q, a matching crc32 csum or filtered=1, and cstate values thahttps://patchthecve.com/cve/CVE-2026-116889.htmlhttps://patchthecve.com/cve/CVE-2026-116889.htmlWed, 28 Oct 2026 15:33:07 +0000MEDIUM 6.1: SemanticMediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject script through Code-typed property values. Attackers can annotate a valid JSON value embedding HTML markup, which the CodeStringValueFormatter renders uneshttps://patchthecve.com/cve/CVE-2026-116888.htmlhttps://patchthecve.com/cve/CVE-2026-116888.htmlWed, 28 Oct 2026 15:32:56 +0000MEDIUM 4.8: SemanticMediaWiki from 3.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with the smw-schemaedit right to inject markup through an unescaped property group schema canonical_name. Attackers can save a schema whose canonical_name holds script markup, which Grouphttps://patchthecve.com/cve/CVE-2026-116884.htmlhttps://patchthecve.com/cve/CVE-2026-116884.htmlWed, 28 Oct 2026 15:32:10 +0000MEDIUM 6.1: SemanticMediaWiki from 5.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability in ext.smw.tooltip.tippy.js that renders data-* attributes via innerHTML with allowHTML enabled. Editors can plant a .smw-highlighter span with a malicious data-content, data-title, data-top, data-bottom, https://patchthecve.com/cve/CVE-2026-116875.htmlhttps://patchthecve.com/cve/CVE-2026-116875.htmlWed, 28 Oct 2026 15:31:42 +0000MEDIUM 6.1: SemanticMediaWiki from 3.0.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in Special:Ask, which outputs separator parameters (sep, propsep, valuesep, delim, separator) without HTML escaping in list, category, DSV, and CSV result printers. Unauthenticated attackers can send vihttps://patchthecve.com/cve/CVE-2026-116874.htmlhttps://patchthecve.com/cve/CVE-2026-116874.htmlWed, 28 Oct 2026 15:30:23 +0000MEDIUM 6.1: SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unescaped default parameter in JsonResultPrinter. Attackers can lure victims to a crafted Special:Ask link with a zero-result query an