CVE-2026-8857

HighCVSS 8.8/10Last modified Oct 25, 2026

Description

A vulnerability in Wikimedia Foundation timeline.

This vulnerability is associated with program files scripts/EasyTimeline.Pl, includes/Timeline.Php.

This issue affects timeline: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Jul 1, 2026
Last modified
Oct 25, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-88588.8IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to remote code execution and denial of service CVE-2026-88599.9IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow an attacker to write arbitrary files to unintended locations due to improper inpuCVE-2026-885929.1kkFileView >= 4.2.0 is vulnerable to Server-Side Request Forgery (SSRF). The cross-origin file proxy endpoint /getCorsFile is protected by TCVE-2026-885936.1kkFileView 5.0.0 through 5.0.2 allows reflected XSS via the /onlinePreview endpoint. The OnlinePreviewController passes the user-controlled CVE-2026-88615.3IBM Security Verify could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in theCVE-2026-886168.8An issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to execute arbitrary code via the FlwTaskController.java component, and the FlwTasCVE-2026-886179.8SmartAdmin v3.30.0 contains an authorization flaw in the configuration query endpoint. This allows a remote attacker to escalate privileges.CVE-2026-886186.51024-lab SmartAdmin v3.30.0 contains a stored cross-site scripting vulnerability in its file upload functionality. This allows a remote attaCVE-2026-886198.11024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in the scheduled-job management module. The AdminSmartJobControllCVE-2026-88627.5IBM Netezza Software 11.3.0.3 through Interim Fix 002 has credentials that are hardcoded in the application source code, allowing unauthorizCVE-2026-886204.3SmartAdmin API Java17 SpringBoot3 version 3.30.0 contains an improper authorization vulnerability in the /employee/queryAll endpoint. The enCVE-2026-886212.7OneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in the Api::upload() method in class/Api.php. An authenticated
CVE-2026-8857: High severity, CVSS 8.8 | Vulnix