CVE-2026-58521

CriticalCVSS 9.8/10Last modified Jul 7, 2026

Description

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection.

This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Jul 1, 2026
Last modified
Jul 7, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-585225.5Relative path traversal in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.CVE-2026-585236.5Improper access control in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-585246.1Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorizCVE-2026-585258.2Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-585267.8Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.CVE-2026-585277.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an authorized attackerCVE-2026-585284.6Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to disclose information with a physical CVE-2026-585297.1Out-of-bounds read in Active Directory Federation Services (AD FS) allows an authorized attacker to disclose information over a network.CVE-2026-58539.8A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this vulnerability is the function setIpv6LCVE-2026-585307.8Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an unauthorized attacker to execute code locally.CVE-2026-585317.5Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB allows an authorized attacker to CVE-2026-585327.8Integer overflow or wraparound in Windows Kernel allows an authorized attacker to elevate privileges locally.