By year
19
20
25
26
Bars are flaws published each year; the red part is the share attackers have used.
Latest high and critical flaws
- CVE-2026-102796 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wikimedia Foundation Mediawiki - UserPageViewTracker ExtenHigh 7.5 · Sep 29, 2026
- CVE-2026-100244 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows Excavation.High 7.5 · Sep 29, 2026
- CVE-2026-100242 Dependency on Vulnerable Third-Party Component and Uncontrolled Resource Consumption vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension alHigh 7.5 · Sep 29, 2026
- CVE-2026-100241 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - EventBus Extension allows Excavation.High 7.5 · Sep 29, 2026
- CVE-2026-100240 Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Accessing Functionality Not Properly Constrained by ACLCritical 9.1 · Sep 29, 2026
- CVE-2026-100382 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Wikimedia Foundation Mediawiki - ExternalData ExtensCritical 10 · Sep 25, 2026
- CVE-2026-0669 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Wikimedia Foundation MediaWiki - CSS extension allows Path TraveHigh 7.5 · Jan 7, 2026
- CVE-2025-53499 Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - AbuseFilter Extension allows Unauthorized Access.This issue affects Mediawiki - AbuseFilCritical 9.1 · Jul 7, 2025
- CVE-2025-53495 Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - AbuseFilter Extension allows Unauthorized Access.This issue affects Mediawiki - AbuseFilCritical 9.1 · Jul 7, 2025
- CVE-2025-53485 SetTranslationHandler.php does not validate that the user is an election admin, allowing any (even unauthenticated) user to change election-related translation High 7.5 · Jul 4, 2025
- CVE-2025-53484 User-controlled inputs are improperly escaped in: * VotePage.php (poll option input) * ResultPage::getPagesTab() and getErrorsTab() (user-controlCritical 9.8 · Jul 4, 2025
- CVE-2025-53483 ArchivePage.php, UnarchivePage.php, and VoterEligibilityPage#executeClear() do not validate request methods or CSRF tokens, allowing attackers to trigger sensitHigh 8.8 · Jul 4, 2025
- CVE-2025-53481 Uncontrolled Resource Consumption vulnerability in Wikimedia Foundation Mediawiki - IPInfo Extension allows Excessive Allocation.This issue affects Mediawiki - High 7.5 · Jul 4, 2025
- CVE-2025-6926 Improper Authentication vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows : Bypass Authentication.This issue affects Mediawiki - CeHigh 8.8 · Jul 3, 2025
- CVE-2025-53501 Improper Access Control vulnerability in Wikimedia Foundation Mediawiki - Scribunto Extension allows : Accessing Functionality Not Properly Constrained by AuthoHigh 8.8 · Jul 3, 2025
- CVE-2013-4572 The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cache session cookies wHigh 7.5 · Feb 6, 2020
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.