https://vulnfeed.org/Every disclosure, as it lands. Critical-only feed available.enhttps://vulnfeed.org/cve/CVE-2026-116880/https://vulnfeed.org/cve/CVE-2026-116880/Tue, 27 Oct 2026 11:17:30 +0000Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site request forgery vulnerability in Special:SMWAdmin because it overwrites the wpEditToken with a freshly generated valid token. Attackers can lure an authenticated smw-admin user to a malicious page that triggers schema setup, entity-disposal, or job actions, causing semantic data loss and resource exhaustion.https://vulnfeed.org/cve/CVE-2026-116873/https://vulnfeed.org/cve/CVE-2026-116873/Tue, 27 Oct 2026 11:17:29 +0000Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask API module that allows unauthenticated attackers to run queued jobs and force store updates. Attackers can use the public anonymous CSRF token with run-joblist to execute arbitrary job types in unbounded counts, or invoke update on sysop-protected pages, leaking page titles and exhausting resources.https://vulnfeed.org/cve/CVE-2026-116876/https://vulnfeed.org/cve/CVE-2026-116876/Tue, 27 Oct 2026 11:17:29 +0000Semantic MediaWiki from 2.5.0 before 7.3.1 contains an improper authorization vulnerability that allows ordinary editors to permanently protect pages by adding an Is edit protected annotation. When $smwgEditProtectionRight is enabled, EditProtectionUpdater applies indefinite edit and move restrictions without checking the author's rights, locking other editors and administrators out.https://vulnfeed.org/cve/CVE-2026-116871/https://vulnfeed.org/cve/CVE-2026-116871/Tue, 27 Oct 2026 11:17:28 +0000Semantic MediaWiki 3.0.0 before 7.3.1 contains an uncontrolled recursion vulnerability in LegacyParser::getSubqueryDescription() that processes nested query tokens before depth limits apply. Unauthenticated attackers can submit deeply nested query elements to the action=ask API to consume substantial CPU and memory, tying up request workers.https://vulnfeed.org/cve/CVE-2026-116872/https://vulnfeed.org/cve/CVE-2026-116872/Tue, 27 Oct 2026 11:17:28 +0000Semantic MediaWiki from 3.0.0 before 7.3.1 contains an algorithmic complexity vulnerability in TermParser::normalize_compact_form() that allows unauthenticated attackers to cause quadratic CPU consumption. Attackers can submit long search terms with many distinct in:(...) or has:(...) expressions to Special:Search to exhaust PHP search workers when the extended search engine is enabled.