TW
Vendor security profile
The Wikimedia Foundation
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs29
Critical1
CISA KEV0
Public exploit0
Patch rate%28
Avg. CVSS4.6
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
0
29
0
CVE KEV
CVE severity distribution
29toplam CVE
Critical1 (3%)
High3 (10%)
Medium14 (48%)
Low11 (38%)
Patch and exploitation view
%28
Verified patch
%0
CISA KEV
%0
Public exploit
8Patch available
0Partial
0Workaround
0Vendor: no patch
21Unknown
Latest vulnerabilities
1.2
CVE-2026-103585
attacker-controlled javascript license URL via XSS
TW
Patch status unknownEPSS %0
1.1
CVE-2026-103584
attacker-controlled javascript license URL via XSS
TW
Patch status unknownEPSS %0
1.2
CVE-2026-103440
pagetriagelist discloses suppressed reviewer usernames
TW
Patch status unknownEPSS %0
0.3
CVE-2026-103439
Various rawParams() and escaped() updates to prevent XSS in Wikibase extension
TW
Patch status unknownEPSS %0
0.3
CVE-2026-103438
Various rawParams() and escaped() updates to prevent XSS in Wikistories extension
TW
Patch status unknownEPSS %0
1.1
CVE-2026-103437
ReadingLists imported metadata permits JavaScript URL XSS
TW
Patch status unknownEPSS %0
7.4
CVE-2026-103446
WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments
TW
Patch status unknownEPSS %0
1.2
CVE-2026-103445
Stored XSS through PageForms #autoedit redirect links
TW
Patch status unknownEPSS %0
1.1
CVE-2026-103444
Stored XSS through system messages in WikiForum
TW
Patch status unknownEPSS %0
1.1
CVE-2026-103443
API permits session-seeded javascript URL XSS
TW
Patch status unknownEPSS %0