Vulnerabilities
Recent vulnerabilities
Recent vulnerabilities from
🏠GNA-1 (CIRCL)
Select from 81 available sources using the dropdown above.
| ID | CVSS | Description | Vendor | Product | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2025-61636 |
0 (4.0)
|
Codex Special:Block vulnerable to message key XSS |
Wikimedia Foundation |
MediaWiki |
2026-02-02T23:23:27.050Z | 2026-02-03T21:13:13.672Z |
| CVE-2025-61637 |
0 (4.0)
|
Stored XSS through system messages in MW Core |
Wikimedia Foundation |
MediaWiki |
2026-02-02T23:54:04.225Z | 2026-02-03T21:10:49.797Z |
| CVE-2025-61638 |
0 (4.0)
|
Sanitizer::validateAttributes data-XSS |
Wikimedia Foundation |
MediaWiki |
2026-02-02T23:52:10.457Z | 2026-02-03T21:10:33.348Z |
| CVE-2025-61640 |
0 (4.0)
|
Stored XSS through system messages in Special:RecentCh… |
Wikimedia Foundation |
MediaWiki |
2026-02-02T23:42:03.791Z | 2026-02-03T21:09:52.646Z |
| CVE-2025-61642 |
0 (4.0)
|
Stored XSS through system messages provided to CodexHt… |
Wikimedia Foundation |
MediaWiki |
2026-02-02T23:36:42.550Z | 2026-02-03T21:16:42.867Z |
| CVE-2025-61644 |
0 (4.0)
|
i18n XSS through Special:Watchlist |
Wikimedia Foundation |
MediaWiki |
2026-02-02T23:57:17.522Z | 2026-02-03T21:03:59.441Z |
| CVE-2025-61645 |
0 (4.0)
|
CodexTablePager has i18n XSS |
Wikimedia Foundation |
MediaWiki |
2026-02-03T00:13:23.359Z | 2026-02-03T21:05:06.109Z |
| CVE-2025-61648 |
0 (4.0)
|
Stored XSS through system messages in CheckUser |
Wikimedia Foundation |
CheckUser |
2026-02-03T00:19:43.150Z | 2026-02-03T21:06:55.920Z |
| CVE-2025-61651 |
0 (4.0)
|
i18n XSS through Special:CheckUser CheckUser helper |
Wikimedia Foundation |
CheckUser |
2026-02-03T00:53:14.630Z | 2026-02-03T21:08:33.097Z |
| CVE-2025-61654 |
0 (4.0)
|
UserInfoCard: Do permission checking when getting coun… |
Wikimedia Foundation |
Thanks |
2026-02-03T01:08:57.273Z | 2026-03-03T15:44:29.769Z |
| CVE-2025-61655 |
0 (4.0)
|
Stored XSS through system messages in VisualEditor |
Wikimedia Foundation |
VisualEditor |
2026-02-03T01:04:35.944Z | 2026-02-03T21:00:52.979Z |
| CVE-2025-61656 |
0 (4.0)
|
XSS when pasting into VE |
Wikimedia Foundation |
VisualEditor |
2026-02-03T01:02:48.955Z | 2026-02-03T21:00:33.782Z |
| CVE-2025-61657 |
0 (4.0)
|
Improper Neutralization of Input During Web Page … |
Wikimedia Foundation |
Vector |
2026-02-03T01:00:59.692Z | 2026-02-03T21:00:15.785Z |
| CVE-2025-6591 |
0 (4.0)
|
HTML injection in API action=feedcontributions output … |
Wikimedia Foundation |
MediaWiki |
2026-02-02T23:02:33.728Z | 2026-02-28T02:52:57.390Z |
| CVE-2025-6596 |
0 (4.0)
|
Vector inserts portlet labels as HTML, allowing for st… |
Wikimedia Foundation |
Vector |
2026-02-02T22:58:20.912Z | 2026-02-03T21:12:11.934Z |
| CVE-2025-6597 |
0 (4.0)
|
MediaWiki should not consider autocreation as login fo… |
Wikimedia Foundation |
MediaWiki |
2026-02-02T22:57:30.161Z | 2026-03-03T15:39:51.521Z |
| CVE-2025-66447 |
0 (3.1)
|
Chamilo LMS has validation-less redirect on login page |
chamilo |
chamilo-lms |
2026-04-10T17:22:32.443Z | 2026-04-14T14:12:56.349Z |
| CVE-2025-67475 |
0 (4.0)
|
Stored XSS through edit summaries in MW Core |
Wikimedia Foundation |
MediaWiki |
2026-02-03T01:21:09.480Z | 2026-02-03T15:32:07.211Z |
| CVE-2025-67477 |
0 (4.0)
|
Stored XSS through a system message in Special:ApiSandbox |
Wikimedia Foundation |
MediaWiki |
2026-02-03T01:16:40.616Z | 2026-02-03T15:32:21.011Z |
| CVE-2025-67478 |
0 (4.0)
|
Wrong E-Mail address composition for usernames with a … |
Wikimedia Foundation |
CheckUser |
2026-02-03T01:14:17.814Z | 2026-03-02T17:43:34.432Z |
| CVE-2025-67479 |
0 (4.0)
|
Magic word replacement in legacy parser allows using r… |
Wikimedia Foundation |
MediaWiki |
2026-02-03T01:12:21.567Z | 2026-03-02T17:42:31.216Z |
| CVE-2025-67480 |
0 (4.0)
|
list=allrevisions can be used to bypass Extension:Lockdown |
Wikimedia Foundation |
MediaWiki |
2026-02-03T01:23:01.717Z | 2026-03-03T15:50:19.557Z |
| CVE-2025-67481 |
0 (4.0)
|
mw.message(…).parse() doesn't output safe HTML, but it… |
Wikimedia Foundation |
MediaWiki |
2026-02-03T01:30:39.642Z | 2026-02-03T15:31:43.813Z |
| CVE-2025-67483 |
0 (4.0)
|
Theoretical i18n XSS in mediawiki.page.preview.js when… |
Wikimedia Foundation |
MediaWiki |
2026-02-03T01:26:27.931Z | 2026-02-03T21:02:32.581Z |
| CVE-2025-67484 |
0 (4.0)
|
Action API xslt option allows JavaScript execution by … |
Wikimedia Foundation |
MediaWiki |
2026-02-03T01:24:56.405Z | 2026-03-03T15:51:26.691Z |
| CVE-2025-68473 |
0 (4.0)
|
ESF-IDF Has Out-of-Bounds Read in ESP32 Bluetooth SDP … |
espressif |
esp-idf |
2025-12-26T23:54:47.709Z | 2025-12-29T16:51:42.074Z |
| CVE-2025-9340 |
0 (4.0)
|
native encrypt/decrypt operations in JCE may corrupt d… |
Legion of the Bouncy Castle Inc. |
Bouncy Castle for Java |
2025-08-22T09:39:47.303Z | 2025-08-22T10:37:18.585Z |
| CVE-2026-12635 |
0 (3.1)
|
Reliance on Reverse DNS Resolution for a Security-Crit… |
GitLab |
GitLab |
2026-06-25T04:33:34.156Z | 2026-06-25T13:25:43.223Z |
| CVE-2026-13706 |
0 (4.0)
|
UrlShortener extension url validation can be bypassed … |
Wikimedia Foundation |
UrlShortener |
2026-07-01T14:29:49.167Z | 2026-07-01T15:44:29.349Z |
| CVE-2026-13707 |
0 (4.0)
|
Session fixation attacks on improperly configured OAut… |
Wikimedia Foundation |
OAuth |
2026-07-01T14:32:26.598Z | 2026-07-01T15:46:18.205Z |