Security feed

24 October 2026

advisoryOfficial CVE List24 Oct 2026

XSS in Cargo's Special:CargoQuery page due to unsanitized table headers

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: before 1.46.1.

Mediawiki - Cargo extension CVE-2026-103049

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-103049

Mediawiki - Cargo extension

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-103049
Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event: #4899 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:59:22 GMT
Publisher date: Tue, 29 Sep 2026 23:08:30 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

Stored XSS in Cargo Drilldown tab names

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in the Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

Mediawiki - Cargo extension CVE-2026-96874

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-96874

Mediawiki - Cargo extension

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-96874
Source reference: /cveMetadata/cveId

Publisher severity

low

Source reference: /containers/cna/metrics

Event: #4056 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:45:25 GMT
Publisher date: Fri, 25 Sep 2026 14:59:58 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

Cargo Exhibit field alias allows stored XSS

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

Mediawiki - Cargo extension CVE-2026-96878

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-96878

Mediawiki - Cargo extension

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-96878
Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event: #4054 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:45:23 GMT
Publisher date: Fri, 25 Sep 2026 19:41:56 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

Reflected XSS through Cargo Drilldown full-text search

Mediawiki - Cargo extension CVE-2026-96877

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-96877

Mediawiki - Cargo extension

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-96877
Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event: #4053 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:45:22 GMT
Publisher date: Fri, 25 Sep 2026 19:39:30 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

Anonymous reflected XSS in CargoExport invalid-alias errors

Mediawiki - Cargo extension CVE-2026-96876

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-96876

Mediawiki - Cargo extension

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-96876
Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event: #4051 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:45:21 GMT
Publisher date: Fri, 25 Sep 2026 19:33:17 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

Reflected XSS in Cargo Drilldown hierarchy filters

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

Mediawiki - Cargo extension CVE-2026-96875

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-96875

Mediawiki - Cargo extension

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-96875
Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event: #4050 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:45:20 GMT
Publisher date: Fri, 25 Sep 2026 19:29:19 GMT

Read the original announcement