Explore CVE records

NonePublished 13 Jul 2026, 17:16 WIB

CVE-2026-4765

Self Cross-Site Scripting (Self-XSS) in Tallos Chat by RD Station Conversas

Self Cross-Site Scripting (Self-XSS) vulnerability in the RD Station Conversas chat feature. The vulnerability lies in the ‘name’ parameter of the initialisation process due to incorrect sanitisation of user-supplied input. Exploitation allows specially crafted JavaScript code to be injected, which is executed within t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS0v4.0KEVNot listedEPSSPresentUpdated09 Sep 2026, 18:55 WIB

Official record

NonePublished 10 Jul 2026, 05:27 WIB

CVE-2026-57501

Zen: Context-menu "Open link in glance" / "Split link in new tab" loads a page-controlled link with the System principal, bypassing the web-content scheme restriction

Zen is a firefox-based browser. Prior to 1.21.5b, Zen's glance and split-view context-menu actions, Open link in glance and Split link in new tab, load a page-controlled link URL with the System principal instead of the originating page's principal, allowing a malicious web page to place a link to a file URL that can l…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

NonePublished 01 Jul 2026, 22:15 WIB

CVE-2026-58028

Pretty-printed API output combined with centralauthtoken allows XSS with certain gadgets

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation CentralAuth. This vulnerability is associated with program files includes/Api/ApiFormatBase.Php, includes/Api/ApiHelp.Php, includes/ResourceLoader/Module.Ph…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS0v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 22:50 WIB

Official record

NonePublished 01 Jul 2026, 22:10 WIB

CVE-2026-58026

$wgNonincludableNamespaces can be bypassed by embedding redirect in other namespaces

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Parser/Parser.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

Excerpt language: en.

CVSS0v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 22:50 WIB

Official record

NonePublished 01 Jul 2026, 22:08 WIB

CVE-2026-8857

Full RCE using EasyTimeline Extension

A vulnerability in Wikimedia Foundation timeline. This vulnerability is associated with program files scripts/EasyTimeline.Pl, includes/Timeline.Php. This issue affects timeline: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

Excerpt language: en.

CVSS0v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 22:49 WIB

Official record

NonePublished 01 Jul 2026, 22:04 WIB

CVE-2026-58038

Stored XSS through javascript URLs in SVGs generated by EasyTimeline

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation timeline. This vulnerability is associated with program files includes/Timeline.Php, scripts/EasyTimeline.Pl. This issue affects timeline: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

Excerpt language: en.

CVSS0v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 22:47 WIB

Official record

NonePublished 01 Jul 2026, 21:51 WIB

CVE-2026-58037

Core log entries for exceptions and XSS issues in log entry formatting code that may be caused by user-controlled input

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Language/Language.Php, includes/Logging/BlockLogFormatter.Php, includes/Logging/LogFormatter.Php, includes/Logging/P…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS0v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 22:46 WIB

Official record

NonePublished 01 Jul 2026, 21:32 WIB

CVE-2026-13707

Session fixation attacks on improperly configured OAuth 1.0a tools

Session fixation vulnerability in Wikimedia Foundation OAuth. This vulnerability is associated with program files src/Backend/MWOAuthServer.Php. This issue affects OAuth: from * through 1.46.0, 1.45.4, 1.44.6, 1.43.9.

Excerpt language: en.

CVSS0v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 22:46 WIB

Official record

NonePublished 01 Jul 2026, 21:29 WIB

CVE-2026-13706

UrlShortener extension url validation can be bypassed due to difference between php url parsing and WHATWG

Improper input validation vulnerability in Wikimedia Foundation UrlShortener. This vulnerability is associated with program files includes/UrlShortenerUtils.Php.

Excerpt language: en.

CVSS0v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 22:44 WIB

Official record

NonePublished 01 Jul 2026, 21:24 WIB

CVE-2026-58031

Stored i18n XSS in Special:ApiSandbox when a deprecated module is selected

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandboxLayout.Js. This issue affects MediaWiki: from 1.46.0-rc.0 before 1.46…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS0v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 21:45 WIB

Official record

NonePublished 01 Jul 2026, 21:21 WIB

CVE-2026-58034

Stored XSS through a system message when blocking a temporary account that's related to other temporary accounts

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files modules/ext.CheckUser.TempAccounts/components/blockConnectedTempAccountsField.Vue. This issue affects CheckUser: from 1.46…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS0v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 21:46 WIB

Official record

NonePublished 01 Jul 2026, 21:17 WIB

CVE-2026-58035

Stored XSS through a system message in the codex version of Special:Block

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Block/SpecialBlock.Vue.

Excerpt language: en.

CVSS0v4.0KEVNot listedEPSSPresentUpdated01 Jul 2026, 21:54 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage