CVE-2026-5762

MediumCVSS 5.3/10Last modified Jul 21, 2026

Description

Allocation of resources without limits or throttling vulnerability in Wikimedia Foundation MediaWiki - ReportIncident Extension allows HTTP DoS. This issue was remediated only on the `master` branch.

Metrics

CVSS 4.0 5.3/10CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-770

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Apr 7, 2026
Last modified
Jul 21, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-576206.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tim Strifler Exclusive Addons ElementoCVE-2026-576219.8Unauthenticated PHP Object Injection in Booktics <= 1.0.21 versions.CVE-2026-576224.3Subscriber Broken Access Control in WPCafe <= 3.0.14 versions.CVE-2026-576239.0Unauthenticated Arbitrary Code Execution in W3 Total Cache <= 2.9.4 versions.CVE-2026-5762410.0Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.46 versions.CVE-2026-576259.6Unauthenticated Cross Site Scripting (XSS) in Admin and Site Enhancements (ASE) Pro <= 8.8.5 versions.CVE-2026-576267.1Cross-Site Request Forgery (CSRF) vulnerability in MailPoet allows Cross Site Request Forgery. This issue affects MailPoet: from 5.30.0 thrCVE-2026-576274.9Subscriber Server Side Request Forgery (SSRF) in Kirki <= 6.0.11 versions.CVE-2026-576287.6Administrator SQL Injection in WP All Import <= 4.0.1 versions.CVE-2026-576296.5Contributor Cross Site Scripting (XSS) in StatCounter <= 2.1.1 versions.CVE-2026-576305.3Unauthenticated Insecure Direct Object References (IDOR) in Blocksy Companion Pro <= 2.1.46 versions.CVE-2026-576317.6Administrator SQL Injection in Popup box <= 6.0.1 versions.
CVE-2026-5762: Medium severity, CVSS 5.3 | Vulnix