CVE WatchJul 9, 2026

CVE-2026-58025

Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files inc

CVSS

9.8

Critical

EPSS

0.5%

p40

KEV

—

Exploit Today

0-100

Published: Jul 1, 2026 · Last modified: Jul 9, 2026 · CWE-94 · CWE-502

EPSS · 30d

0.3%EPSS · 30 days0.5%

2026-07-022026-07-17

Technical description

Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/WikiImporter.Php, includes/Import/WikiRevision.Php, includes/Logging/LogEntryBase.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

Official references

phabricator.wikimedia.orghttps://phabricator.wikimedia.org/T422244

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2025-32489.8 CRI

100.0%

KEV—80Langflow Missing Authentication Vulnerability3d CVE-2021-422379.8 CRI

99.9%

KEV—80Sitecore XP Remote Command Execution Vulnerability9d CVE-2026-341978.8 HIG

99.9%

KEV—80Apache ActiveMQ Improper Input Validation Vulnerability3d CVE-2026-456598.8 HIG

86.8%

KEV—76Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability16d CVE-2026-154107.2 HIG

71.1%

KEV—71SonicWall SMA1000 Appliances Code Injection Vulnerability2d CVE-2026-586449.8 CRI

70.7%

KEV—71Microsoft SharePoint Deserialization of Untrusted Data Vulnerability1d