CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Free accounts get a daily email of the CVEs that match up to 3 of their products on My program; subscribers get each one the moment it is published. Where the data comes from: sources.

Updated under an hour ago (Oct 29, 2026, 8:50 PM ET)

What this means for you

This week: 3,260 CVEs published, 236 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stackFree account, 3 products This week's critical CVEs Exploited in the last 30 days

Published in the last 7 days: 3,260; Show in the list
Critical, last 7 days: 236; Show in the list
Healthcare-tagged, last 7 days: 5; Show in the list
Known exploited (CISA KEV): 1,762; Show in the list

Showing CVEs that name the product wikimedia_foundation:mediawiki. Show all products

45 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2026-58025	Medium 5.9	Remote Code Execution via Unsafe Deserialization in LogItem Import Assigned by wikimedia-foundation	Jul 1, 2026
CVE-2026-58029	Medium 5.3	Full Account Takeover from BotPasswords and OAuth via action=changeauthenticationdata Assigned by wikimedia-foundation	Jul 1, 2026
CVE-2026-58028	None 0.0	Pretty-printed API output combined with centralauthtoken allows XSS with certain gadgets Assigned by wikimedia-foundation	Jul 1, 2026
CVE-2026-58026	None 0.0	$wgNonincludableNamespaces can be bypassed by embedding redirect in other namespaces Assigned by wikimedia-foundation	Jul 1, 2026
CVE-2026-58032	Medium 5.3	mw.Api.getErrorMessage() may return injected HTML if used without errorformat=html Assigned by wikimedia-foundation	Jul 1, 2026
CVE-2026-58033	Medium 5.3	"Total number of distinct authors" statistic at action=info does not exclude revisions where the author name was deleted Assigned by wikimedia-foundation	Jul 1, 2026
CVE-2026-58037	None 0.0	Core log entries for exceptions and XSS issues in log entry formatting code that may be caused by user-controlled input Assigned by wikimedia-foundation	Jul 1, 2026
CVE-2026-58036	Low 2.1	Users API leaks whether privileged users have their user groups disabled for lack of 2FA Assigned by wikimedia-foundation	Jul 1, 2026
CVE-2026-58024	Medium 5.1	API identification of users on private wikis Assigned by wikimedia-foundation	Jul 1, 2026
CVE-2026-58031	None 0.0	Stored i18n XSS in Special:ApiSandbox when a deprecated module is selected Assigned by wikimedia-foundation	Jul 1, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.