CVE-2026-22714

LowCVSS 2.3/10Last modified Jun 17, 2026

Description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Monaco Skin allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Monaco Skin: 1.45, 1.44, 1.43, 1.39.

Metrics

CVSS 4.0 2.3/10

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
The Wikimedia Foundation	Mediawiki - Monaco Skin	1.45; 1.44; 1.43; 1.39

References

Timeline

Published: Jan 9, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-227155.9VMWare Workstation and Fusion contain a logic flaw in the management of network packets. Known attack vectors: A malicious actor with admi CVE-2026-227165.0Out-of-bound write vulnerability in VMware Workstation 25H1 and below on any platform allows an actor with non-administrative privileges on CVE-2026-227172.7Out-of-bound read vulnerability in VMware Workstation 25H1 and below on any platform allows an actor with non-administrative privileges on a CVE-2026-227186.8The VSCode extension for Spring CLI are vulnerable to command injection, resulting in command execution on the users machine.CVE-2026-227198.1VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbit CVE-2026-22726.5A flaw was found in GIMP. An integer overflow vulnerability exists when processing ICO image files, specifically in the `ico_read_info` and CVE-2026-227209.0VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with privileges to create custom benchmarks m CVE-2026-227217.2VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with privileges in vCenter to access Aria Operations CVE-2026-227226.1A malicious actor with authenticated user privileges on a Windows based Workstation host may be able to cause a null pointer dereference err CVE-2026-227236.5Inappropriate user token revocation due to a logic error in the token revocation endpoint implementation in Cloudfoundry UAA v77.30.0 to v78 CVE-2026-227265.0Route Services can be leveraged to send app traffic to network destinations outside of an app's configured egress rules. As a result, a mali CVE-2026-227277.5Unprotected internal endpoints in Cloud Foundry Capi Release 1.226.0 and below, and CF Deployment v54.9.0 and below on all platforms allows