Skip to content
Weblateorg vulnerabilities
Newest
-
weblateorg weblate
Weblate: Mercurial argument injection via repository filenames allows authenticated command execution
CVE-2026-86035
8.5 High
-
weblateorg wlc
wlc may disclose API tokens to project-configured URLs
CVE-2026-62364
Fix available
2.3 Low
-
weblateorg weblate
Weblate: DNS rebinding in VCS operations allows server-side request forgery
CVE-2026-77573
3.5 Low
-
weblateorg weblate
Weblate: Object-scoped RSS feeds disclose private change history to unauthorized users
CVE-2026-77507
5.3 Medium
-
weblateorg weblate
Weblate Has Uncontrolled Resource Consumption via
CVE-2026-62326
6.5 Medium
-
weblateorg weblate
Weblate: Restricted-component change history leaked to non-member project users through the nested `GET /api/projects/{slug}/changes/` endpoint
CVE-2026-62249
4.3 Medium
-
weblateorg weblate
Weblate path traversal allows a project administrator to read arbitrary files via App store metadata download (Incomplete Fix of CVE-2026-34242)
CVE-2026-61792
7.7 High
-
weblateorg weblate
Weblate: Team-enforced 2FA is bypassed for global permissions
CVE-2026-61790
4.4 Medium
-
weblateorg weblate
Weblate:: WebIDOR in GroupViewSet allows authenticated project manager to gain unauthorized read access to any private project
CVE-2026-55228
Fix available
8.1 High
-
weblateorg weblate
Observable object existence disclosure in private Weblate projects via globally scoped object lookups
CVE-2026-55227
Fix available
4.3 Medium
-
weblateorg weblate
Weblate: Unverified REST API email changes
CVE-2026-77508
3.5 Low
-
weblateorg weblate
Weblate SSRF: outbound URL guard misses the NAT64 well-known prefix (64:ff9b::/96)
CVE-2026-50127
Fix available
5.9 Medium
-
weblateorg weblate
Weblate: Stored HTML injection in editor search preview
CVE-2026-45106
Fix available
4.6 Medium
-
weblate
Weblate is vulnerable to XSS via crafted Markdown
CVE-2026-44264
Fix available
4.3 Medium
-
weblate
Weblate: Private Translation Enumeration via Screenshot API
CVE-2026-44263
Fix available
4.3 Medium
-
weblate
Weblate is Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url
CVE-2026-41654
Fix available
5.3 Medium
-
weblate
Weblate's API Token Not Invalidated on Password Change
CVE-2026-41519
Fix available
4.2 Medium
-
weblate wlc
wlc: print_html outputs API data without HTML escaping, enabling stored XSS
CVE-2026-42150
Fix available
5.1 Medium
-
weblate
Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision
CVE-2026-40256
Fix available
5.0 Medium
-
weblate
Weblate: SSRF via the webhook add-on using unprotected fetch_url()
CVE-2026-39845
Fix available
4.1 Medium
-
weblate
Weblate: Privilege escalation in the user API endpoint
CVE-2026-34393
Fix available
8.8 High
-
weblate
Weblate: SSRF via Project-Level Machinery Configuration
CVE-2026-34244
Fix available
5.0 Medium
-
weblate
Weblate: Arbitrary File Read via Symlink
CVE-2026-34242
Fix available
7.7 High
-
weblate
Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads
CVE-2026-33440
Fix available
5.0 Medium
-
weblate
Weblate: Remote code execution during backup restoration
CVE-2026-33435
Fix available
8.1 High
-
weblate
Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository
CVE-2026-33220
Fix available
6.8 Medium
-
weblate
Weblate has improper access control for the translation memory API
CVE-2026-33214
Fix available
4.3 Medium
-
weblate
Weblate: Improper access control for pending tasks in API
CVE-2026-33212
Fix available
3.1 Low
-
weblate
Weblate: Missing access control for the AddonViewSet API exposes all addon configurations
CVE-2026-27457
Fix available
4.3 Medium
-
weblate
Weblate has an argument injection in management console
CVE-2026-24126
Public exploitFix available
6.6 Medium
-
weblate wlc
wlc Path traversal: Unsanitized API slugs in download command
CVE-2026-23535
Fix available
8.1 High
-
weblate
Weblate leaks information via screenshots
CVE-2026-21889
Fix available
2.3 Low
-
weblate wlc
wlc may leak API keys due to an insecure API key configuration
CVE-2026-22251
Fix available
5.3 Medium
-
weblate wlc
wlc can skip SSL verification
CVE-2026-22250
Fix available
2.5 Low
-
weblate
Weblate has git config file overwrite vulnerability that leads to remote code execution
CVE-2025-68398
Fix available
9.1 Critical
-
weblate
Weblate has an arbitrary file read via symbolic links
CVE-2025-68279
Fix available
7.7 High
-
weblate
Weblate has Server-Side Request Forgery vulnerability
CVE-2025-66407
Fix available
5.0 Medium
-
weblate
Weblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR)
CVE-2025-67715
Fix available
4.3 Medium
-
weblate
Weblate's over‑permissive webhook endpoint enables mass repository updates and component enumeration
CVE-2025-67492
Fix available
5.3 Medium
-
weblate
Weblate has improper validation upon invitation acceptance
CVE-2025-64725
Fix available
1.0 Low
-
weblate
Weblate leaks the IP of project members inviting users to assume reviewer roles in Audit log
CVE-2025-64326
Fix available
2.6 Low
-
weblate
Weblate integration with Anubis can lead to Open Redirect via redir parameter
CVE-2025-61587
Fix available
2.1 Low
-
weblate
Weblate has long session expiry times during second factor verification
CVE-2025-58352
Fix available
2.1 Low
-
weblate
Weblate exposes personal IP address via e-mail
CVE-2025-49134
Fix available
2.1 Low
-
weblate
Weblate lacks rate limiting when verifying second factor
CVE-2025-47951
Fix available
4.9 Medium
-
weblate
Weblate VCS credentials included in URL parameters are potentially logged and saved into browser history as plaintext
CVE-2025-32021
Fix available
2.2 Low
-
weblate
Weblate vulnerabler to improper sanitization of project backups
CVE-2024-39303
Fix available
4.4 Medium
-
weblate
Remote Code Execution (RCE)
CVE-2022-23915
Fix available
7.2 High
-
weblate
Cross-site Scripting in Weblate
CVE-2022-24710
Fix available
5.4 Medium