Weblateorg Weblate vulnerabilities

• weblateorg weblate Weblate: Mercurial argument injection via repository filenames allows authenticated command execution CVE-2026-86035 8.5 HighSeptember 29, 2026
• weblateorg weblate Weblate: DNS rebinding in VCS operations allows server-side request forgery CVE-2026-77573 3.5 LowAugust 26, 2026
• weblateorg weblate Weblate: Object-scoped RSS feeds disclose private change history to unauthorized users CVE-2026-77507 5.3 MediumAugust 26, 2026
• weblateorg weblate Weblate Has Uncontrolled Resource Consumption via CVE-2026-62326 6.5 MediumAugust 26, 2026
• weblateorg weblate Weblate: Restricted-component change history leaked to non-member project users through the nested `GET /api/projects/{slug}/changes/` endpoint CVE-2026-62249 4.3 MediumAugust 26, 2026
• weblateorg weblate Weblate path traversal allows a project administrator to read arbitrary files via App store metadata download (Incomplete Fix of CVE-2026-34242) CVE-2026-61792 7.7 HighAugust 26, 2026
• weblateorg weblate Weblate: Team-enforced 2FA is bypassed for global permissions CVE-2026-61790 4.4 MediumAugust 26, 2026
• weblateorg weblate Weblate:: WebIDOR in GroupViewSet allows authenticated project manager to gain unauthorized read access to any private project CVE-2026-55228 Fix available 8.1 HighAugust 26, 2026
• weblateorg weblate Observable object existence disclosure in private Weblate projects via globally scoped object lookups CVE-2026-55227 Fix available 4.3 MediumAugust 26, 2026
• weblateorg weblate Weblate: Unverified REST API email changes CVE-2026-77508 3.5 LowAugust 26, 2026
• weblateorg weblate Weblate SSRF: outbound URL guard misses the NAT64 well-known prefix (64:ff9b::/96) CVE-2026-50127 Fix available 5.9 MediumJune 10, 2026
• weblateorg weblate Weblate: Stored HTML injection in editor search preview CVE-2026-45106 Fix available 4.6 MediumMay 15, 2026
• weblate Weblate is vulnerable to XSS via crafted Markdown CVE-2026-44264 Fix available 4.3 MediumMay 7, 2026
• weblate Weblate: Private Translation Enumeration via Screenshot API CVE-2026-44263 Fix available 4.3 MediumMay 7, 2026
• weblate Weblate is Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url CVE-2026-41654 Fix available 5.3 MediumApril 30, 2026
• weblate Weblate's API Token Not Invalidated on Password Change CVE-2026-41519 Fix available 4.2 MediumApril 30, 2026
• weblate Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision CVE-2026-40256 Fix available 5.0 MediumApril 15, 2026
• weblate Weblate: SSRF via the webhook add-on using unprotected fetch_url() CVE-2026-39845 Fix available 4.1 MediumApril 15, 2026
• weblate Weblate: Privilege escalation in the user API endpoint CVE-2026-34393 Fix available 8.8 HighApril 15, 2026
• weblate Weblate: SSRF via Project-Level Machinery Configuration CVE-2026-34244 Fix available 5.0 MediumApril 15, 2026
• weblate Weblate: Arbitrary File Read via Symlink CVE-2026-34242 Fix available 7.7 HighApril 15, 2026
• weblate Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads CVE-2026-33440 Fix available 5.0 MediumApril 15, 2026
• weblate Weblate: Remote code execution during backup restoration CVE-2026-33435 Fix available 8.1 HighApril 15, 2026
• weblate Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository CVE-2026-33220 Fix available 6.8 MediumApril 15, 2026
• weblate Weblate has improper access control for the translation memory API CVE-2026-33214 Fix available 4.3 MediumApril 15, 2026
• weblate Weblate: Improper access control for pending tasks in API CVE-2026-33212 Fix available 3.1 LowApril 15, 2026
• weblate Weblate: Missing access control for the AddonViewSet API exposes all addon configurations CVE-2026-27457 Fix available 4.3 MediumFebruary 26, 2026
• weblate Weblate has an argument injection in management console CVE-2026-24126 Public exploitFix available 6.6 MediumFebruary 17, 2026
• weblate Weblate leaks information via screenshots CVE-2026-21889 Fix available 2.3 LowJanuary 14, 2026
• weblate Weblate has git config file overwrite vulnerability that leads to remote code execution CVE-2025-68398 Fix available 9.1 CriticalDecember 18, 2025
• weblate Weblate has an arbitrary file read via symbolic links CVE-2025-68279 Fix available 7.7 HighDecember 18, 2025
• weblate Weblate has Server-Side Request Forgery vulnerability CVE-2025-66407 Fix available 5.0 MediumDecember 15, 2025
• weblate Weblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR) CVE-2025-67715 Fix available 4.3 MediumDecember 15, 2025
• weblate Weblate's over‑permissive webhook endpoint enables mass repository updates and component enumeration CVE-2025-67492 Fix available 5.3 MediumDecember 15, 2025
• weblate Weblate has improper validation upon invitation acceptance CVE-2025-64725 Fix available 1.0 LowDecember 15, 2025
• weblate Weblate leaks the IP of project members inviting users to assume reviewer roles in Audit log CVE-2025-64326 Fix available 2.6 LowNovember 5, 2025
• weblate Weblate integration with Anubis can lead to Open Redirect via redir parameter CVE-2025-61587 Fix available 2.1 LowOctober 1, 2025
• weblate Weblate has long session expiry times during second factor verification CVE-2025-58352 Fix available 2.1 LowSeptember 4, 2025
• weblate Weblate exposes personal IP address via e-mail CVE-2025-49134 Fix available 2.1 LowJune 16, 2025
• weblate Weblate lacks rate limiting when verifying second factor CVE-2025-47951 Fix available 4.9 MediumJune 16, 2025
• weblate Weblate VCS credentials included in URL parameters are potentially logged and saved into browser history as plaintext CVE-2025-32021 Fix available 2.2 LowApril 15, 2025
• weblate Weblate vulnerabler to improper sanitization of project backups CVE-2024-39303 Fix available 4.4 MediumJuly 1, 2024
• weblate Remote Code Execution (RCE) CVE-2022-23915 Fix available 7.2 HighMarch 4, 2022
• weblate Cross-site Scripting in Weblate CVE-2022-24710 Fix available 5.4 MediumFebruary 25, 2022