Weblate vulnerabilities

Products

• Weblate 33
• Wlc 4

Newest

• weblate Weblate is vulnerable to XSS via crafted Markdown CVE-2026-44264 Fix available 4.3 MediumMay 7, 2026
• weblate Weblate: Private Translation Enumeration via Screenshot API CVE-2026-44263 Fix available 4.3 MediumMay 7, 2026
• weblate Weblate is Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url CVE-2026-41654 Fix available 5.3 MediumApril 30, 2026
• weblate Weblate's API Token Not Invalidated on Password Change CVE-2026-41519 Fix available 4.2 MediumApril 30, 2026
• weblate wlc wlc: print_html outputs API data without HTML escaping, enabling stored XSS CVE-2026-42150 Fix available 5.1 MediumApril 24, 2026
• weblate Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision CVE-2026-40256 Fix available 5.0 MediumApril 15, 2026
• weblate Weblate: SSRF via the webhook add-on using unprotected fetch_url() CVE-2026-39845 Fix available 4.1 MediumApril 15, 2026
• weblate Weblate: Privilege escalation in the user API endpoint CVE-2026-34393 Fix available 8.8 HighApril 15, 2026
• weblate Weblate: SSRF via Project-Level Machinery Configuration CVE-2026-34244 Fix available 5.0 MediumApril 15, 2026
• weblate Weblate: Arbitrary File Read via Symlink CVE-2026-34242 Fix available 7.7 HighApril 15, 2026
• weblate Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads CVE-2026-33440 Fix available 5.0 MediumApril 15, 2026
• weblate Weblate: Remote code execution during backup restoration CVE-2026-33435 Fix available 8.1 HighApril 15, 2026
• weblate Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository CVE-2026-33220 Fix available 6.8 MediumApril 15, 2026
• weblate Weblate has improper access control for the translation memory API CVE-2026-33214 Fix available 4.3 MediumApril 15, 2026
• weblate Weblate: Improper access control for pending tasks in API CVE-2026-33212 Fix available 3.1 LowApril 15, 2026
• weblate Weblate: Missing access control for the AddonViewSet API exposes all addon configurations CVE-2026-27457 Fix available 4.3 MediumFebruary 26, 2026
• weblate Weblate has an argument injection in management console CVE-2026-24126 Public exploitFix available 6.6 MediumFebruary 17, 2026
• weblate wlc wlc Path traversal: Unsanitized API slugs in download command CVE-2026-23535 Fix available 8.1 HighJanuary 16, 2026
• weblate Weblate leaks information via screenshots CVE-2026-21889 Fix available 2.3 LowJanuary 14, 2026
• weblate wlc wlc may leak API keys due to an insecure API key configuration CVE-2026-22251 Fix available 5.3 MediumJanuary 12, 2026
• weblate wlc wlc can skip SSL verification CVE-2026-22250 Fix available 2.5 LowJanuary 12, 2026
• weblate Weblate has git config file overwrite vulnerability that leads to remote code execution CVE-2025-68398 Fix available 9.1 CriticalDecember 18, 2025
• weblate Weblate has an arbitrary file read via symbolic links CVE-2025-68279 Fix available 7.7 HighDecember 18, 2025
• weblate Weblate has Server-Side Request Forgery vulnerability CVE-2025-66407 Fix available 5.0 MediumDecember 15, 2025
• weblate Weblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR) CVE-2025-67715 Fix available 4.3 MediumDecember 15, 2025
• weblate Weblate's over‑permissive webhook endpoint enables mass repository updates and component enumeration CVE-2025-67492 Fix available 5.3 MediumDecember 15, 2025
• weblate Weblate has improper validation upon invitation acceptance CVE-2025-64725 Fix available 1.0 LowDecember 15, 2025
• weblate Weblate leaks the IP of project members inviting users to assume reviewer roles in Audit log CVE-2025-64326 Fix available 2.6 LowNovember 5, 2025
• weblate Weblate integration with Anubis can lead to Open Redirect via redir parameter CVE-2025-61587 Fix available 2.1 LowOctober 1, 2025
• weblate Weblate has long session expiry times during second factor verification CVE-2025-58352 Fix available 2.1 LowSeptember 4, 2025
• weblate Weblate exposes personal IP address via e-mail CVE-2025-49134 Fix available 2.1 LowJune 16, 2025
• weblate Weblate lacks rate limiting when verifying second factor CVE-2025-47951 Fix available 4.9 MediumJune 16, 2025
• weblate Weblate VCS credentials included in URL parameters are potentially logged and saved into browser history as plaintext CVE-2025-32021 Fix available 2.2 LowApril 15, 2025
• weblate Weblate vulnerabler to improper sanitization of project backups CVE-2024-39303 Fix available 4.4 MediumJuly 1, 2024
• weblate Remote Code Execution (RCE) CVE-2022-23915 Fix available 7.2 HighMarch 4, 2022
• weblate Cross-site Scripting in Weblate CVE-2022-24710 Fix available 5.4 MediumFebruary 25, 2022
• weblate Weblate user account enumeration via reset password form CVE-2017-5537 Fix available 5.3 MediumMarch 15, 2017