CVE-2026-100378

Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - Translate Extension allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - Translate Extension: from before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-100376

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Cross-Site Scripting XSS. This issue affects Mediawiki - TemplateSandbox Extension: from before 1.46.1, 1.45.5, 1.43.10...

MAL-2026-17188 Malicious code in sherpy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 561bac708df60298c46df70c27282912b3955ec3fd83a23e251c268e814cdcbf The sherpy package presents itself as an OSINT command-line tool but ships all of its logic inside a 10.8 MB precompiled PyO3 native module at...

Malicious code in sherpy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 561bac708df60298c46df70c27282912b3955ec3fd83a23e251c268e814cdcbf The sherpy package presents itself as an OSINT command-line tool but ships all of its logic inside a 10.8 MB precompiled PyO3 native module at...

CVE-2026-100383 Stored i18n XSS in WikiLambda's VisualEditor integration

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Cross-Site Scripting XSS. This issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has been remediated on the...

CVE-2026-100383

The Mediawiki - WikiLambda Extension version 1.47.0-alpha is vulnerable to Cross-Site Scripting (XSS) due to Improper Neutralization of Input During Web Page Generation . An attacker with high privileges and passive user interaction could potentially execute scripts in the context of the victim's...

CVE-2026-100383 Stored i18n XSS in WikiLambda's VisualEditor integration

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Cross-Site Scripting XSS. This issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has been remediated on the...

CVE-2026-100382

The MediaWiki ExternalData Extension is vulnerable to OS Command Injection in versions prior to 3.7 . The root cause resides in the #get_program_data parser function (class EDConnectorExe), which interpolates user-supplied parameters into an admin-defined command template and splits them using ex...

CVE-2026-100382 Unauthenticated remote code execution through wikitext in ExternalData

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Wikimedia Foundation Mediawiki - ExternalData Extension allows OS Command Injection. This issue affects Mediawiki - ExternalData Extension: from before 3.7...

CVE-2026-100382 Unauthenticated remote code execution through wikitext in ExternalData

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Wikimedia Foundation Mediawiki - ExternalData Extension allows OS Command Injection. This issue affects Mediawiki - ExternalData Extension: from before 3.7...

CVE-2026-6103

A flaw was found in PHP. An integer overflow vulnerability in the Phar extension occurs when parsing TAR archive headers containing excessively large size fields. An attacker can exploit this issue by supplying a specially crafted archive file to an application that processes TAR archives, causin...

CVE-2026-100381 UploadWizard Flickr collection and set titles allow DOM XSS

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - UploadWizard Extension allows Cross-Site Scripting XSS. This issue affects Mediawiki - UploadWizard Extension: from before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-100381

The Wikimedia Foundation Mediawiki - UploadWizard Extension is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. Specifically, the Flickr collection and set titles allow for DOM XSS . This issue affects versions prior to 1.46.1 , 1.45.5 ,...

CVE-2026-100381 UploadWizard Flickr collection and set titles allow DOM XSS

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - UploadWizard Extension allows Cross-Site Scripting XSS. This issue affects Mediawiki - UploadWizard Extension: from before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-100380

The Wikimedia Foundation Mediawiki - Wikibase Extension is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw due to improper neutralization of input during web page generation. Specifically, the issue exists within the Special:SetLabel language validation component. This vulnerability aff...

CVE-2026-100380 Reflected XSS in Wikibase Special:SetLabel language validation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows Cross-Site Scripting XSS. This issue affects Mediawiki - Wikibase Extension: from before 1.46.1, 1.45.5, 1.43.10...

EUVD-2026-87345

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows Cross-Site Scripting XSS. This issue affects Mediawiki - Wikibase Extension: from before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-100380 Reflected XSS in Wikibase Special:SetLabel language validation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows Cross-Site Scripting XSS. This issue affects Mediawiki - Wikibase Extension: from before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-100378 Missing permission check in the Translate sandbox doRemind action

Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - Translate Extension allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - Translate Extension: from before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-100378

The Mediawiki - Translate Extension contains a Missing Authorization vulnerability that allows for accessing functionality not properly constrained by Access Control Lists (ACLs). Specifically, the issue involves a missing permission check in the Translate sandbox doRemind action . This vulnerabi...