CVE-2026-33541 | Medium | 6.5 | 2026-03-26 | TSPortal is the WikiTide Foundation’s in-house platform used by the Trust and Safety team to manage reports, investigations, appeals, and transparency work. Pr… |
CVE-2026-29788 | High | 7.5 | 2026-03-06 | TSPortal is the WikiTide Foundation’s in-house platform used by the Trust and Safety team to manage reports, investigations, appeals, and transparency work. Pr… |
CVE-2025-53371 | Critical | 9.1 | 2025-07-10 | DiscordNotifications is an extension for MediaWiki that sends notifications of actions in your Wiki to a Discord channel. DiscordNotifications allows sending r… |
CVE-2025-43861 | Medium | 4.4 | 2025-04-24 | ManageWiki is a MediaWiki extension allowing users to manage wikis. Prior to commit 2f177dc, ManageWiki is vulnerable to reflected or stored XSS in the review… |
CVE-2025-32964 | Medium | 4.6 | 2025-04-22 | ManageWiki is a MediaWiki extension allowing users to manage wikis. Prior to commit 00bebea, when enabling a conflicting extension, a restricted extension woul… |
CVE-2025-32956 | High | 8.0 | 2025-04-21 | ManageWiki is a MediaWiki extension allowing users to manage wikis. Versions before commit f504ed8, are vulnerable to SQL injection when renaming a namespace i… |
CVE-2024-47816 | Medium | 6.4 | 2024-10-09 | ImportDump is a mediawiki extension designed to automate user import requests. A user's local actor ID is stored in the database to tell who made what requests… |
CVE-2024-47815 | Medium | 6.0 | 2024-10-09 | IncidentReporting is a MediaWiki extension for moving incident reports from wikitext to database tables. There are a variety of Cross-site Scripting issues, th… |
CVE-2024-47812 | Medium | 6.0 | 2024-10-09 | ImportDump is an extension for mediawiki designed to automate user import requests. Anyone who can edit the interface strings of a wiki (typically administrato… |
CVE-2024-47782 | High | 7.6 | 2024-10-07 | WikiDiscover is an extension designed for use with a CreateWiki managed farm to display wikis. Special:WikiDiscover is a special page that lists all wikis on t… |
CVE-2024-47781 | Medium | 6.1 | 2024-10-07 | CreateWiki is an extension used at Miraheze for requesting & creating wikis. The name of requested wikis is not escaped on Special:RequestWikiQueue, so a user… |
CVE-2024-47612 | Low | 3.5 | 2024-10-02 | DataDump is a MediaWiki extension that provides dumps of wikis. Several interface messages are unescaped (more specifically, (datadump-table-column-queued), (d… |
CVE-2024-34701 | Medium | 5.9 | 2024-05-14 | CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. It is possible for users to be considered as the requester of a specific wiki req… |
CVE-2024-29898 | Medium | 4.9 | 2024-03-28 | CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. An oversight during the writing of the patch for CVE-2024-29897 may have exposed… |
CVE-2024-29897 | Medium | 4.9 | 2024-03-28 | CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. It is possible for users with (delete) or (suppressrevision) on any wiki in the f… |
CVE-2024-29883 | Medium | 4.9 | 2024-03-26 | CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. Suppression of wiki requests does not work as intended, and always restricts visi… |
CVE-2024-25109 | Medium | 6.5 | 2024-02-09 | ManageWiki is a MediaWiki extension allowing users to manage wikis. Special:ManageWiki does not escape escape interface messages on the `columns` and `help` ke… |
CVE-2024-25107 | Medium | 4.9 | 2024-02-08 | WikiDiscover is an extension designed for use with a CreateWiki managed farm to display wikis. On Special:WikiDiscover, the `Language::date` function is used w… |
CVE-2022-24813 | Medium | 5.3 | 2022-04-04 | CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. Without the patch for this issue, anonymous comments can be made using Special:Re… |
CVE-2021-39186 | Medium | 4.3 | 2021-09-01 | GlobalNewFiles is a MediaWiki extension maintained by Miraheze. Prior to commit number cee254e1b158cdb0ddbea716b1d3edc31fa4fb5d, the username column of the Glo… |
CVE-2021-32774 | Medium | 6.1 | 2021-07-20 | DataDump is a MediaWiki extension that provides dumps of wikis. Prior to commit 67a82b76e186925330b89ace9c5fd893a300830b, DataDump had no protection against CS… |
CVE-2021-32722 | Medium | 6.5 | 2021-06-28 | GlobalNewFiles is a mediawiki extension. Versions prior to 48be7adb70568e20e961ea1cb70904454a671b1d are affected by an uncontrolled resource consumption vulner… |
CVE-2021-29483 | Critical | 9.4 | 2021-04-28 | ManageWiki is an extension to the MediaWiki project. The 'wikiconfig' API leaked the value of private configuration variables set through the ManageWiki variab… |