MediaWiki 関連製品全体の CVE とセキュリティ脆弱性情報を集約し、CVSS、EPSS、公開日、脆弱性情報データを掲載しています。
一般的な弱点パターンには パス処理の欠陥、vendor risk csrf、vendor risk input validation, and vendor risk open redirect があり、vendor surface production workloads and vendor surface software deployment の利用場面で ファイル上書き、vendor impact unexpected behavior, and vendor impact data exposure などのリスクが生じる可能性があります。
掲載データは公開脆弱性情報とセキュリティ公告に基づき、過去の暴露面と修補優先度の評価に利用できます。
| CVE | 概要 | ソース | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|---|
| CVE-2026-14363 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4. | c4f26cc8-17ff-4c99-b5e2-38fc1793eacc | 6.9 | 0.26% | 2026-07-01 | 2026-07-07 |
| CVE-2026-58517 | Improper neutralization of input terminators vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Authentication Bypass. This issue affects Mediawiki - WikiLambda Extension: from * before 1.43.9,1.44.6,1.45.4. | c4f26cc8-17ff-4c99-b5e2-38fc1793eacc | 6.9 | 0.21% | 2026-07-01 | 2026-07-10 |
| CVE-2026-14358 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Charts Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - Charts Extension: from * before 1.43.9,1.44.6,1.45.4. | c4f26cc8-17ff-4c99-b5e2-38fc1793eacc | 6.9 | 0.18% | 2026-07-01 | 2026-07-09 |
| CVE-2026-58521 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4. | c4f26cc8-17ff-4c99-b5e2-38fc1793eacc | 6.9 | 0.28% | 2026-07-01 | 2026-07-07 |
| CVE-2026-58520 | URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - UrlShortener Extension allows Cross-Site Flashing. This issue affects Mediawiki - UrlShortener Extension: from * before 1.43.9, 1.44.6, 1.45.4. | c4f26cc8-17ff-4c99-b5e2-38fc1793eacc | 6.9 | 0.18% | 2026-07-01 | 2026-07-09 |
| CVE-2026-8857 | A vulnerability in Wikimedia Foundation timeline. This vulnerability is associated with program files scripts/EasyTimeline.Pl, includes/Timeline.Php. This issue affects timeline: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9. | c4f26cc8-17ff-4c99-b5e2-38fc1793eacc | 0.0 | 0.27% | 2026-07-01 | 2026-07-09 |
| CVE-2026-58038 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation timeline. This vulnerability is associated with program files includes/Timeline.Php, scripts/EasyTimeline.Pl. This issue affects timeline: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9. | c4f26cc8-17ff-4c99-b5e2-38fc1793eacc | 0.0 | 0.17% | 2026-07-01 | 2026-07-09 |
| CVE-2026-58037 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Language/Language.Php, includes/Logging/BlockLogFormatter.Php, includes/Logging/LogFormatter.Php, includes/Logging/PatrolLogFormatter.Php, includes/Logging/RenameuserLogFormatter.Php, includes/Logging/TagLogFormatter.Php, includes/Specials/SpecialVersion.Php. This issue affects MediaWiki: fro | c4f26cc8-17ff-4c99-b5e2-38fc1793eacc | 0.0 | 0.27% | 2026-07-01 | 2026-07-09 |
| CVE-2026-58036 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiQueryAllUsers.Php, includes/Api/ApiQueryUsers.Php, includes/Permissions/PermissionManager.Php, includes/User/UserGroupManager.Php. | c4f26cc8-17ff-4c99-b5e2-38fc1793eacc | 2.1 | 0.24% | 2026-07-01 | 2026-07-09 |
| CVE-2026-58033 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Actions/InfoAction.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9. | c4f26cc8-17ff-4c99-b5e2-38fc1793eacc | 5.3 | 0.43% | 2026-07-01 | 2026-07-09 |
| CVE-2026-58032 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Api/index.Js. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9. | c4f26cc8-17ff-4c99-b5e2-38fc1793eacc | 5.3 | 0.25% | 2026-07-01 | 2026-07-09 |
| CVE-2026-58030 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation SyntaxHighlight_GeSHi. This vulnerability is associated with program files includes/SyntaxHighlight.Php. This issue affects SyntaxHighlight_GeSHi: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9. | c4f26cc8-17ff-4c99-b5e2-38fc1793eacc | 5.3 | 0.27% | 2026-07-01 | 2026-07-09 |
| CVE-2026-58029 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiChangeAuthenticationData.Php, includes/Api/ApiLinkAccount.Php, includes/Api/ApiRemoveAuthenticationData.Php, includes/Specials/SpecialLinkAccounts.Php, includes/Specials/SpecialUnlinkAccounts.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9. | c4f26cc8-17ff-4c99-b5e2-38fc1793eacc | 5.3 | 0.35% | 2026-07-01 | 2026-07-09 |
| CVE-2026-58028 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation CentralAuth. This vulnerability is associated with program files includes/Api/ApiFormatBase.Php, includes/Api/ApiHelp.Php, includes/ResourceLoader/Module.Php, includes/Hooks/Handlers/PageDisplayHookHandler.Php, includes/LogFormatter/PermissionChangeLogFormatter.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6 | c4f26cc8-17ff-4c99-b5e2-38fc1793eacc | 0.0 | 0.27% | 2026-07-01 | 2026-07-09 |
| CVE-2026-58027 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program files includes/Api/QueryAbuseFilters.Php. This issue affects AbuseFilter: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9. | c4f26cc8-17ff-4c99-b5e2-38fc1793eacc | 5.3 | 0.38% | 2026-07-01 | 2026-07-09 |
| CVE-2026-58026 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Parser/Parser.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9. | c4f26cc8-17ff-4c99-b5e2-38fc1793eacc | 0.0 | 0.37% | 2026-07-01 | 2026-07-09 |
| CVE-2026-58025 | Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/WikiImporter.Php, includes/Import/WikiRevision.Php, includes/Logging/LogEntryBase.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9. | c4f26cc8-17ff-4c99-b5e2-38fc1793eacc | 5.9 | 0.50% | 2026-07-01 | 2026-07-09 |
| CVE-2026-58024 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiUserrights.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9. | c4f26cc8-17ff-4c99-b5e2-38fc1793eacc | 5.1 | 0.37% | 2026-07-01 | 2026-07-09 |
| CVE-2026-13707 | Session fixation vulnerability in Wikimedia Foundation OAuth. This vulnerability is associated with program files src/Backend/MWOAuthServer.Php. This issue affects OAuth: from * through 1.46.0, 1.45.4, 1.44.6, 1.43.9. | c4f26cc8-17ff-4c99-b5e2-38fc1793eacc | 0.0 | 0.22% | 2026-07-01 | 2026-07-13 |
| CVE-2026-13706 | Improper input validation vulnerability in Wikimedia Foundation UrlShortener. This vulnerability is associated with program files includes/UrlShortenerUtils.Php. | c4f26cc8-17ff-4c99-b5e2-38fc1793eacc | 0.0 | 0.28% | 2026-07-01 | 2026-07-09 |