{"schema_version":"1","data":[{"id":4899,"advisory_id":"f6fc1d31-5332-4746-89bc-0235105e1c0b","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-103049","source_published_at":"2026-09-29T23:08:30.389+00:00","published_at":"2026-10-24T21:59:22.041956+00:00","extraction_method":"structured","technologies":["core-cve","mediawiki-cargo-extension"],"cve_ids":["CVE-2026-103049"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"XSS in Cargo's Special:CargoQuery page due to unsanitized table headers","summary":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: before 1.46.1.","evidence":"cve:CVE-2026-103049","products":[{"name":{"value":"Mediawiki - Cargo extension","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-103049","aliases":["CVE-2026-103049"],"metrics":[],"affected":[{"repo":"https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions/Cargo/+/refs/heads/master","vendor":"The Wikimedia Foundation","product":"Mediawiki - Cargo extension","versions":[{"status":"affected","version":"0","lessThan":"1.46.1","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-30T20:01:34.079Z","provider":"cve","references":["https://phabricator.wikimedia.org/T431567","https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1310132"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-103049","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T20:01:09.530452Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T20:01:34.079Z"}}],"cna":{"orgId":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","shortName":"wikimedia-foundation","dateUpdated":"2026-09-29T23:08:30.389Z"}}},"related_cves":[{"value":"CVE-2026-103049","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null}},{"id":4056,"advisory_id":"1dad5e7b-96f0-42d7-a7f9-1839892c4ac0","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-96874","source_published_at":"2026-09-25T14:59:58.002+00:00","published_at":"2026-10-24T21:45:25.019903+00:00","extraction_method":"structured","technologies":["core-cve","mediawiki-cargo-extension"],"cve_ids":["CVE-2026-96874"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Stored XSS in Cargo Drilldown tab names","summary":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in the Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.","evidence":"cve:CVE-2026-96874","products":[{"name":{"value":"Mediawiki - Cargo extension","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","structured":{"id":"CVE-2026-96874","aliases":["CVE-2026-96874"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":2.3,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"LOW","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"LOW","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"The Wikimedia Foundation","product":"Mediawiki - Cargo extension","versions":[{"status":"affected","version":"0","versionType":"semver","lessThanOrEqual":"3.9.4"}],"defaultStatus":"unaffected"}],"modified":"2026-09-29T21:38:31.945Z","provider":"cve","references":["https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1328631","https://phabricator.wikimedia.org/T435207"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-96874","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-25T16:07:08.411563Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T16:07:18.783Z"}}],"cna":{"orgId":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","shortName":"wikimedia-foundation","dateUpdated":"2026-09-29T21:38:31.945Z"}}},"related_cves":[{"value":"CVE-2026-96874","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":4054,"advisory_id":"eac74a1c-b687-4f2b-8ccd-24c402dab86b","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-96878","source_published_at":"2026-09-25T19:41:56.483+00:00","published_at":"2026-10-24T21:45:23.398112+00:00","extraction_method":"structured","technologies":["core-cve","mediawiki-cargo-extension"],"cve_ids":["CVE-2026-96878"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Cargo Exhibit field alias allows stored XSS","summary":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.","evidence":"cve:CVE-2026-96878","products":[{"name":{"value":"Mediawiki - Cargo extension","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-96878","aliases":["CVE-2026-96878"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6.9,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"The Wikimedia Foundation","product":"Mediawiki - Cargo extension","versions":[{"status":"affected","version":"0","versionType":"semver","lessThanOrEqual":"3.9.4"}],"defaultStatus":"unaffected"}],"modified":"2026-09-29T21:21:41.691Z","provider":"cve","references":["https://phabricator.wikimedia.org/T434784","https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1328627"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-96878","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-25T20:05:20.312201Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T20:05:55.276Z"}}],"cna":{"orgId":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","shortName":"wikimedia-foundation","dateUpdated":"2026-09-29T21:21:41.691Z"}}},"related_cves":[{"value":"CVE-2026-96878","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":4053,"advisory_id":"81095bc7-5278-4cd6-94d6-91397f5b9c2a","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-96877","source_published_at":"2026-09-25T19:39:30.872+00:00","published_at":"2026-10-24T21:45:22.827396+00:00","extraction_method":"structured","technologies":["core-cve","mediawiki-cargo-extension"],"cve_ids":["CVE-2026-96877"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Reflected XSS through Cargo Drilldown full-text search","summary":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.","evidence":"cve:CVE-2026-96877","products":[{"name":{"value":"Mediawiki - Cargo extension","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-96877","aliases":["CVE-2026-96877"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6.9,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"The Wikimedia Foundation","product":"Mediawiki - Cargo extension","versions":[{"status":"affected","version":"0","versionType":"semver","lessThanOrEqual":"3.9.4"}],"defaultStatus":"unaffected"}],"modified":"2026-09-29T21:21:04.824Z","provider":"cve","references":["https://phabricator.wikimedia.org/T434977","https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1328628"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-96877","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-25T20:05:35.671289Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T20:06:06.807Z"}}],"cna":{"orgId":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","shortName":"wikimedia-foundation","dateUpdated":"2026-09-29T21:21:04.824Z"}}},"related_cves":[{"value":"CVE-2026-96877","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":4051,"advisory_id":"b68acbee-71d6-427b-8cd1-f42766b62fd6","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-96876","source_published_at":"2026-09-25T19:33:17.7+00:00","published_at":"2026-10-24T21:45:21.196696+00:00","extraction_method":"structured","technologies":["core-cve","mediawiki-cargo-extension"],"cve_ids":["CVE-2026-96876"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Anonymous reflected XSS in CargoExport invalid-alias errors","summary":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.","evidence":"cve:CVE-2026-96876","products":[{"name":{"value":"Mediawiki - Cargo extension","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-96876","aliases":["CVE-2026-96876"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6.9,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"The Wikimedia Foundation","product":"Mediawiki - Cargo extension","versions":[{"status":"affected","version":"0","versionType":"semver","lessThanOrEqual":"3.9.4"}],"defaultStatus":"unaffected"}],"modified":"2026-09-29T21:20:24.081Z","provider":"cve","references":["https://phabricator.wikimedia.org/T435121","https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1328630"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-96876","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-25T20:38:36.379087Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T20:38:45.555Z"}}],"cna":{"orgId":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","shortName":"wikimedia-foundation","dateUpdated":"2026-09-29T21:20:24.081Z"}}},"related_cves":[{"value":"CVE-2026-96876","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":4050,"advisory_id":"be81fd3f-deae-495d-8062-e241fc1d0a5b","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-96875","source_published_at":"2026-09-25T19:29:19.032+00:00","published_at":"2026-10-24T21:45:20.592044+00:00","extraction_method":"structured","technologies":["core-cve","mediawiki-cargo-extension"],"cve_ids":["CVE-2026-96875"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Reflected XSS in Cargo Drilldown hierarchy filters","summary":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.","evidence":"cve:CVE-2026-96875","products":[{"name":{"value":"Mediawiki - Cargo extension","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-96875","aliases":["CVE-2026-96875"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6.9,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"The Wikimedia Foundation","product":"Mediawiki - Cargo extension","versions":[{"status":"affected","version":"0","versionType":"semver","lessThanOrEqual":"3.9.4"}],"defaultStatus":"unaffected"}],"modified":"2026-09-29T21:19:24.823Z","provider":"cve","references":["https://phabricator.wikimedia.org/T435206#12360644","https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1328629"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-96875","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-25T20:39:00.566462Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-25T20:39:14.078Z"}}],"cna":{"orgId":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","shortName":"wikimedia-foundation","dateUpdated":"2026-09-29T21:19:24.823Z"}}},"related_cves":[{"value":"CVE-2026-96875","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}}],"next_after":4899,"next_before":4050}