Composer mediawiki/core has 28 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2023-45363 | MediaWiki Denial of Service vulnerability | high | 7.5 | <1.35.12 or >=1.36.0 and <1.39.5 or >=1.40.0 and <1.40.1 | 1.35.12, 1.39.5, 1.40.1 |
| CVE-2019-12468 | Wikimedia MediaWiki Incorrect Access Control vulnerability | critical | 9.8 | >=1.27.0 and <1.27.6 or >=1.30.0 and <1.30.2 or >=1.31.0 and <1.31.2 or >=1.32.0 and <1.32.2 | 1.27.6, 1.30.2, 1.31.2, 1.32.2 |
| CVE-2018-0504 | Mediawiki information disclosure vulnerability | medium | 6.5 | >=1.27.0 and <1.27.5 or >=1.29.0 and <1.29.3 or >=1.30.0 and <1.30.1 or >=1.31.0 and <1.31.1 | 1.27.5, 1.29.3, 1.30.1, 1.31.1 |
| CVE-2014-2853 | Cross-site scripting vulnerability in includes/actions/InfoAction.php | medium | 0.0 | <1.21.9 or >=1.22.0 and <1.22.6 | 1.21.9, 1.22.6 |
| CVE-2019-12473 | Wikimedia Potential DOS due to slow WatchedItemStore::countVisitingWatchersMultiple | high | 7.5 | >=1.27.0 and <1.27.6 or >=1.30.0 and <1.30.2 or >=1.31.0 and <1.31.2 or >=1.32.0 and <1.32.2 | 1.27.6, 1.30.2, 1.31.2, 1.32.2 |
| CVE-2018-13258 | Mediawiki tarball is missing .htaccess files | medium | 5.3 | >=1.31.0 and <1.31.1 | 1.31.1 |
| CVE-2019-12474 | Wikimedia information leak vulnerability | high | 7.5 | >=1.27.0 and <1.27.6 or >=1.30.0 and <1.30.2 or >=1.31.0 and <1.31.2 or >=1.32.0 and <1.32.2 | 1.27.6, 1.30.2, 1.31.2, 1.32.2 |
| CVE-2018-0505 | Mediawiki BotPassword can bypass CentralAuth's account lock | medium | 6.5 | >=1.27.0 and <1.27.5 or >=1.29.0 and <1.29.3 or >=1.30.0 and <1.30.1 or >=1.31.0 and <1.31.1 | 1.27.5, 1.29.3, 1.30.1, 1.31.1 |
| CVE-2021-41800 | MediaWiki allows a denial of service | medium | 5.3 | <1.36.2 | 1.36.2 |
| CVE-2019-16738 | MediaWiki information disclosure | medium | 5.3 | >=1.31.0 and <1.31.4 or >=1.32.0 and <1.32.4 or >=1.33.0 and <1.33.1 | 1.31.4, 1.32.4, 1.33.1 |
| CVE-2020-25827 | OATHAuth extension in MediaWiki is not implementing rate limit | high | 7.5 | >=1.31.0 and <1.31.9 or >=1.32.0 and <1.34.3 or >=1.34.0 and <1.34.3 | 1.31.9, 1.34.3 |
| CVE-2019-19709 | Possible to circumvent title-blacklist | medium | 6.1 | >=1.31.0 and <1.31.6 or >=1.32.0 and <1.32.6 or >=1.33.0 and <1.33.2 or >=1.33.99 and <1.34.0 | 1.31.6, 1.32.6, 1.33.2, 1.34.0 |
| CVE-2018-0503 | Mediawiki Improper Privilege Management | medium | 4.3 | >=1.27.0 and <1.27.5 or >=1.29.0 and <1.29.3 or >=1.30.0 and <1.30.1 or >=1.31.0 and <1.31.1 | 1.27.5, 1.29.3, 1.30.1, 1.31.1 |
| CVE-2020-10959 | MediaWiki Open Redirect vulnerability | medium | 6.1 | <1.34.0-rc.0 or >=1.34.0 and <1.34.1 | 1.34.0-rc.0, 1.34.1 |
| CVE-2019-12470 | Wikimedia MediaWik exposed suppressed log in RevisionDelete page | medium | 6.5 | >=1.27.0 and <1.27.6 or >=1.30.0 and <1.30.2 or >=1.31.0 and <1.31.2 or >=1.32.0 and <1.32.2 | 1.27.6, 1.30.2, 1.31.2, 1.32.2 |
| CVE-2019-12469 | MediaWiki Incorrect Access Control vulnerability | medium | 6.5 | >=1.27.0 and <1.27.6 or >=1.30.0 and <1.30.2 or >=1.31.0 and <1.31.2 or >=1.32.0 and <1.32.2 | 1.27.6, 1.30.2, 1.31.2, 1.32.2 |
| CVE-2020-25814 | MediaWiki Cross-site Scripting (XSS) vulnerability | medium | 6.1 | >=1.31.0 and <1.31.9 or >=1.32.0 and <1.34.3 or >=1.35.0-rc.0 and <1.35.0 or >=1.34.0 and <1.34.3 or >=1.34.99 and <1.35.0 | 1.31.9, 1.34.3, 1.35.0 |
| CVE-2019-12472 | MediaWiki Incorrect Access Control vulnerability | high | 7.5 | >=1.18.0 and <1.27.6 or >=1.30.0 and <1.30.2 or >=1.31.0 and <1.31.2 or >=1.32.0 and <1.32.2 or >=1.27.0 and <1.27.6 | 1.27.6, 1.30.2, 1.31.2, 1.32.2 |
| CVE-2020-15005 | img_auth.php may leak private extension images into the public cache | medium | 0.0 | <1.31.8 or >=1.32.0 and <1.33.4 or >=1.34.0 and <1.34.2 | 1.31.8, 1.33.4, 1.34.2 |
| CVE-2020-25813 | MediaWiki Special:UserRights exposes the existence of hidden users | medium | 5.3 | >=1.31.0 and <1.31.9 or >=1.32.0 and <1.34.3 or >=1.34.0 and <1.34.3 | 1.31.9, 1.34.3 |
| CVE-2019-12471 | MediaWiki Cross-site Scripting (XSS) | medium | 6.1 | >=1.27.0 and <1.27.6 or >=1.30.0 and <1.30.2 or >=1.31.0 and <1.31.2 | 1.27.6, 1.30.2, 1.31.2 |
| CVE-2019-12467 | MediaWiki Incorrect Access Control vulnerability | medium | 5.3 | <1.27.6 or >=1.30.0 and <1.30.2 or >=1.31.0 and <1.31.2 or >=1.32.0 and <1.32.2 or >=1.27.0 and <1.27.6 | 1.27.6, 1.30.2, 1.31.2, 1.32.2 |
| CVE-2023-29141 | X-Forwarded-For header allows brute-forcing autoblocked IP addresses | critical | 9.8 | >=1.39.0 and <1.39.3 or >=1.38.0 and <1.38.6 or <1.35.10 | 1.39.3, 1.38.6, 1.35.10 |
| CVE-2020-10960 | MediaWiki makeCollapsible allows applying event handler to any CSS selector | medium | 5.3 | >=1.31.0 and <1.31.7 or >=1.33.0 and <1.33.3 or >=1.34.0 and <1.34.1 | 1.31.7, 1.33.3, 1.34.1 |
| CVE-2020-25812 | MediaWiki Cross-site Scripting (XSS) vulnerability | medium | 6.1 | >=1.34.0 and <1.34.3 or >=1.35.0-rc.0 and <1.35.0 or >=1.34.99 and <1.35.0 | 1.34.3, 1.35.0 |
| CVE-2020-25815 | MediaWiki Cross-site Scripting (XSS) vulnerability | medium | 6.1 | >=1.32.0 and <1.34.3 or >=1.35.0-rc.0 and <1.35.0 or >=1.34.0 and <1.34.3 or >=1.34.99 and <1.35.0 | 1.34.3, 1.35.0 |
| CVE-2020-25828 | MediaWiki Cross-site Scripting (XSS) vulnerability | medium | 6.1 | >=1.31.0 and <1.31.9 or >=1.32.0 and <1.34.3 or >=1.35.0-rc.0 and <1.35.0 or >=1.34.0 and <1.34.3 or >=1.34.99 and <1.35.0 | 1.31.9, 1.34.3, 1.35.0 |
| CVE-2019-12466 | Wikimedia MediaWiki allows CSRF | high | 8.8 | >=1.27.0 and <1.27.6 or >=1.30.0 and <1.30.2 or >=1.31.0 and <1.31.2 or >=1.32.0 and <1.32.2 or >=1.32.99 and <1.33.0 | 1.27.6, 1.30.2, 1.31.2, 1.32.2 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked