WWeblateOrg

Products

Exploited and recent CVEs

• CVE-2026-86035 High 8.5 Weblate: Mercurial argument injection via repository filenames allows authenticated command execution 0.5%
• CVE-2026-62364 Low 2.3 wlc may disclose API tokens to project-configured URLs <0.1%
• CVE-2026-77573 Low 3.5 Weblate: DNS rebinding in VCS operations allows server-side request forgery 0.2%
• CVE-2026-77507 Medium 5.3 Weblate: Object-scoped RSS feeds disclose private change history to unauthorized users 0.4%
• CVE-2026-62326 Medium 6.5 Weblate Has Uncontrolled Resource Consumption via 0.5%
• CVE-2026-62249 Medium 4.3 Weblate: Restricted-component change history leaked to non-member project users through the nested `GET /api/projects/{slug}/changes/` endpoint 0.3%
• CVE-2026-61792 High 7.7 Weblate path traversal allows a project administrator to read arbitrary files via App store metadata download (Incomplete Fix of CVE-2026-34242) 0.6%
• CVE-2026-61790 Medium 4.4 Weblate: Team-enforced 2FA is bypassed for global permissions 0.4%
• CVE-2026-55228 High 8.1 Weblate:: WebIDOR in GroupViewSet allows authenticated project manager to gain unauthorized read access to any private project 0.4%
• CVE-2026-55227 Medium 4.3 Observable object existence disclosure in private Weblate projects via globally scoped object lookups 0.3%
• CVE-2026-77508 Low 3.5 Weblate: Unverified REST API email changes 0.3%
• CVE-2026-45106 Medium 4.6 Weblate: Stored HTML injection in editor search preview 0.2%
• CVE-2026-50127 Medium 5.9 Weblate SSRF: outbound URL guard misses the NAT64 well-known prefix (64:ff9b::/96) 0.3%
• CVE-2026-42150 Medium 5.1 wlc: print_html outputs API data without HTML escaping, enabling stored XSS 0.2%
• CVE-2026-44264 Medium 4.3 Weblate is vulnerable to XSS via crafted Markdown 0.3%
• CVE-2026-44263 Medium 4.3 Weblate: Private Translation Enumeration via Screenshot API 0.3%
• CVE-2026-41519 Medium 4.2 Weblate's API Token Not Invalidated on Password Change 0.3%
• CVE-2026-41654 Medium 5.3 Weblate is Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url 0.4%
• CVE-2026-40256 Medium 5.0 Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision 0.3%
• CVE-2026-39845 Medium 4.1 Weblate: SSRF via the webhook add-on using unprotected fetch_url() 0.3%
• CVE-2026-34393 High 8.8 Weblate: Privilege escalation in the user API endpoint 0.4%
• CVE-2026-34244 Medium 5.0 Weblate: SSRF via Project-Level Machinery Configuration 0.3%
• CVE-2026-34242 High 7.7 Weblate: Arbitrary File Read via Symlink 0.5%
• CVE-2026-33440 Medium 5.0 Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads 0.2%
• CVE-2026-33435 High 8.1 Weblate: Remote code execution during backup restoration 0.7%
• CVE-2026-33220 Medium 6.8 Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository 0.3%
• CVE-2026-33214 Medium 4.3 Weblate has improper access control for the translation memory API 0.2%
• CVE-2026-33212 Low 3.1 Weblate: Improper access control for pending tasks in API 0.2%
• CVE-2026-27457 Medium 4.3 Weblate: Missing access control for the AddonViewSet API exposes all addon configurations 0.3%
• CVE-2026-24126 Medium 6.6 Weblate has an argument injection in management console 0.5%