WF
Vendor security profile
Wikimedia Foundation
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs16
Critical2
CISA KEV0
Public exploit2
Patch rate%0
Avg. CVSS6.6
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
0
16
0
CVE KEV
CVE severity distribution
16toplam CVE
Critical2 (13%)
High4 (25%)
Medium10 (63%)
Patch and exploitation view
%0
Verified patch
%0
CISA KEV
%13
Public exploit
0Patch available
0Partial
0Workaround
0Vendor: no patch
16Unknown
Latest vulnerabilities
1.2
CVE-2026-103585
attacker-controlled javascript license URL via XSS
TW
Patch status unknownEPSS %0
1.1
CVE-2026-103584
attacker-controlled javascript license URL via XSS
TW
Patch status unknownEPSS %0
1.2
CVE-2026-103440
pagetriagelist discloses suppressed reviewer usernames
TW
Patch status unknownEPSS %0
0.3
CVE-2026-103439
Various rawParams() and escaped() updates to prevent XSS in Wikibase extension
TW
Patch status unknownEPSS %0
0.3
CVE-2026-103438
Various rawParams() and escaped() updates to prevent XSS in Wikistories extension
TW
Patch status unknownEPSS %0
1.1
CVE-2026-103437
ReadingLists imported metadata permits JavaScript URL XSS
TW
Patch status unknownEPSS %0
7.4
CVE-2026-103446
WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments
TW
Patch status unknownEPSS %0
1.2
CVE-2026-103445
Stored XSS through PageForms #autoedit redirect links
TW
Patch status unknownEPSS %0
1.1
CVE-2026-103444
Stored XSS through system messages in WikiForum
TW
Patch status unknownEPSS %0
1.1
CVE-2026-103443
API permits session-seeded javascript URL XSS
TW
Patch status unknownEPSS %0