What is the CVSS score of CVE-2026-0668?

CVE-2026-0668 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.1%.

Which versions of Mediawiki are affected by CVE-2026-0668?

CVE-2026-0668 presents moderate security risk rated CVSS 5.3. Exploitation could compromise the security of affected deployments. Proof-of-concept code is publicly available.. A patch is available.

Is there a public PoC exploit available for CVE-2026-0668?

Yes, a public proof-of-concept exploit is available for CVE-2026-0668. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-0668?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Mediawiki CVE-2026-0668

MEDIUM

Inefficient Regular Expression Complexity (ReDoS) (CWE-1333)

2026-01-07 c4f26cc8-17ff-4c99-b5e2-38fc1793eacc

Mediawiki Red Hat Visualdata

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Red Hat

6.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 24, 2026 - 18:32 vuln.today

Public exploit code

Patch released

Feb 24, 2026 - 18:32 nvd

Patch available

CVE Published

Jan 07, 2026 - 18:15 nvd

MEDIUM 5.3

DescriptionCVE.org

Inefficient Regular Expression Complexity vulnerability in Wikimedia Foundation MediaWiki - VisualData Extension allows Regular Expression Exponential Blowup.This issue affects MediaWiki - VisualData Extension: 1.45.

AnalysisAI

Visualdata versions up to - is affected by inefficient regular expression complexity (redos) (CVSS 5.3).

Technical ContextAI

This vulnerability (CWE-1333: Inefficient Regular Expression Complexity (ReDoS)) affects Visualdata. Inefficient Regular Expression Complexity vulnerability in Wikimedia Foundation MediaWiki - VisualData Extension allows Regular Expression Exponential Blowup.This issue affects MediaWiki - VisualData Extension: 1.45.

RemediationAI

A vendor patch is available — apply it immediately. Restrict network access to the affected service where possible.

More in Mediawiki

View all

CVE-2014-1610 MEDIUM This Month POC

6.0 Jan 30

MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is

CVE-2015-8009 CRITICAL Act Now POC

9.8 Jul 25

The MWOAuthDataStore::lookup_token function in Extension:OAuth for MediaWiki 1.25.x before 1.25.3, 1.24.x before 1.24.4,

CVE-2023-37303 CRITICAL Act Now POC

9.8 Jun 30

An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. Rated critical severity (CVSS 9.8), thi

CVE-2022-29906 CRITICAL Act Now POC

9.8 Apr 29

The admin API module in the QuizGame extension for MediaWiki through 1.37.2 (before 665e33a68f6fa1167df99c0aa18ed0157cdf

CVE-2022-29904 CRITICAL Act Now POC

9.8 Apr 29

The SemanticDrilldown extension for MediaWiki through 1.37.2 (before e688bdba6434591b5dff689a45e4d53459954773) allows SQ

CVE-2022-28206 CRITICAL Act Now POC

9.8 Mar 30

An issue was discovered in MediaWiki through 1.37.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely

CVE-2022-28205 CRITICAL Act Now POC

9.8 Mar 30

An issue was discovered in MediaWiki through 1.37.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely

CVE-2021-36128 CRITICAL Act Now POC

9.8 Jul 02

An issue was discovered in the CentralAuth extension in MediaWiki through 1.36. Rated critical severity (CVSS 9.8), this

CVE-2021-36126 CRITICAL Act Now POC

9.8 Jul 02

An issue was discovered in the AbuseFilter extension in MediaWiki through 1.36. Rated critical severity (CVSS 9.8), this

CVE-2017-8809 CRITICAL Act Now

9.8 Nov 15

api.php in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has a Reflected File Download vulnera

CVE-2024-47849 HIGH This Week POC

8.8 Oct 05

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foun

CVE-2021-36132 HIGH This Week POC

8.8 Jul 02

An issue was discovered in the FileImporter extension in MediaWiki through 1.36. Rated high severity (CVSS 8.8), this vu

Same weakness CWE-1333 – Inefficient Regular Expression Complexity (ReDoS)

View all

CVE-2023-29486 CRITICAL POC

9.8

CVE-2023-29487 CRITICAL POC

9.1

CVE-2026-48801 HIGH POC

8.7

CVE-2024-58340 HIGH POC

8.7

CVE-2026-0621 HIGH POC

8.7

CVE-2024-21490 HIGH POC

7.5

CVE-2022-42969 HIGH POC

7.5

CVE-2015-8315 HIGH POC

7.5

Vendor StatusVendor

CVE-2026-0668 vulnerability details – vuln.today

Back

Mediawiki CVE-2026-0668

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Mediawiki

Same weakness CWE-1333 – Inefficient Regular Expression Complexity (ReDoS)

Vendor StatusVendor

Share

External POC / Exploit Code