https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T21:36:30.915919+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-34087 CVE-2026-34087 — Users API leaks whether privileged users have their user groups disabled for lack of 2FA 2026-09-29T21:36:30.934561+00:00

Affected: Wikimedia Foundation OATHAuth

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation OATHAuth.

This issue affects OATHAuth: from * before 1.43.7, 1.44.4, 1.45.2.

 https://vulnerability.circl.lu/vuln/usn-8315-1 USN-8315-1 — mediawiki vulnerabilities 2026-09-29T21:36:30.934662+00:00

Affected: Ubuntu:Pro:20.04:LTS: mediawiki, Ubuntu:Pro:22.04:LTS: mediawiki, Ubuntu:Pro:24.04:LTS: mediawiki

It was discovered that MediaWiki incorrectly handled group membership visibility in the OATHAuth extension. An authenticated attacker could use this issue to determine if other users had two-factor authentication enabled. (CVE-2026-34087)

It was discovered that MediaWiki incorrectly handled suppressed log entry titles in the RecentChanges list. An unauthenticated attacker could use this issue to view titles of deleted or suppressed pages that should be hidden. (CVE-2026-34088)

It was discovered that MediaWiki incorrectly handled resource loading timing information. An attacker could use this issue to determine if certain pages existed on a wiki. (CVE-2026-34092)