WeblateOrg weblate

• CVE-2026-86035 High 8.5 Weblate: Mercurial argument injection via repository filenames allows authenticated command execution 0.5%
• CVE-2026-77573 Low 3.5 Weblate: DNS rebinding in VCS operations allows server-side request forgery 0.2%
• CVE-2026-77507 Medium 5.3 Weblate: Object-scoped RSS feeds disclose private change history to unauthorized users 0.4%
• CVE-2026-62326 Medium 6.5 Weblate Has Uncontrolled Resource Consumption via 0.5%
• CVE-2026-62249 Medium 4.3 Weblate: Restricted-component change history leaked to non-member project users through the nested `GET /api/projects/{slug}/changes/` endpoint 0.3%
• CVE-2026-61792 High 7.7 Weblate path traversal allows a project administrator to read arbitrary files via App store metadata download (Incomplete Fix of CVE-2026-34242) 0.6%
• CVE-2026-61790 Medium 4.4 Weblate: Team-enforced 2FA is bypassed for global permissions 0.4%
• CVE-2026-55228 High 8.1 Weblate:: WebIDOR in GroupViewSet allows authenticated project manager to gain unauthorized read access to any private project 0.4%
• CVE-2026-55227 Medium 4.3 Observable object existence disclosure in private Weblate projects via globally scoped object lookups 0.3%
• CVE-2026-77508 Low 3.5 Weblate: Unverified REST API email changes 0.3%
• CVE-2026-45106 Medium 4.6 Weblate: Stored HTML injection in editor search preview 0.2%
• CVE-2026-50127 Medium 5.9 Weblate SSRF: outbound URL guard misses the NAT64 well-known prefix (64:ff9b::/96) 0.3%
• CVE-2026-44264 Medium 4.3 Weblate is vulnerable to XSS via crafted Markdown 0.3%
• CVE-2026-44263 Medium 4.3 Weblate: Private Translation Enumeration via Screenshot API 0.3%
• CVE-2026-41519 Medium 4.2 Weblate's API Token Not Invalidated on Password Change 0.3%
• CVE-2026-41654 Medium 5.3 Weblate is Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url 0.4%
• CVE-2026-40256 Medium 5.0 Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision 0.3%
• CVE-2026-39845 Medium 4.1 Weblate: SSRF via the webhook add-on using unprotected fetch_url() 0.3%
• CVE-2026-34393 High 8.8 Weblate: Privilege escalation in the user API endpoint 0.4%
• CVE-2026-34244 Medium 5.0 Weblate: SSRF via Project-Level Machinery Configuration 0.3%
• CVE-2026-34242 High 7.7 Weblate: Arbitrary File Read via Symlink 0.5%
• CVE-2026-33440 Medium 5.0 Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads 0.2%
• CVE-2026-33435 High 8.1 Weblate: Remote code execution during backup restoration 0.7%
• CVE-2026-33220 Medium 6.8 Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository 0.3%
• CVE-2026-33214 Medium 4.3 Weblate has improper access control for the translation memory API 0.2%
• CVE-2026-33212 Low 3.1 Weblate: Improper access control for pending tasks in API 0.2%
• CVE-2026-27457 Medium 4.3 Weblate: Missing access control for the AddonViewSet API exposes all addon configurations 0.3%
• CVE-2026-24126 Medium 6.6 Weblate has an argument injection in management console 0.5%
• CVE-2026-21889 Low 2.3 Weblate leaks information via screenshots 0.4%
• CVE-2025-68398 Critical 9.1 Weblate has git config file overwrite vulnerability that leads to remote code execution 0.8%
• CVE-2025-68279 High 7.7 Weblate has an arbitrary file read via symbolic links 0.4%
• CVE-2025-67715 Medium 4.3 Weblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR) 0.3%
• CVE-2025-67492 Medium 5.3 Weblate's over‑permissive webhook endpoint enables mass repository updates and component enumeration 0.3%
• CVE-2025-66407 Medium 5.0 Weblate has Server-Side Request Forgery vulnerability 0.2%
• CVE-2025-64725 Low 1.0 Weblate has improper validation upon invitation acceptance 0.3%
• CVE-2025-64326 Low 2.6 Weblate leaks the IP of project members inviting users to assume reviewer roles in Audit log 0.2%
• CVE-2025-61587 Low 2.1 Weblate integration with Anubis can lead to Open Redirect via redir parameter 0.4%
• CVE-2025-58352 Low 2.1 Weblate has long session expiry times during second factor verification 0.3%
• CVE-2025-49134 Low 2.1 Weblate exposes personal IP address via e-mail 0.3%
• CVE-2025-47951 Medium 4.9 Weblate lacks rate limiting when verifying second factor 0.3%
• CVE-2025-32021 Low 2.2 Weblate VCS credentials included in URL parameters are potentially logged and saved into browser history as plaintext 0.4%
• CVE-2024-39303 Medium 4.4 Weblate vulnerabler to improper sanitization of project backups 0.3%
• CVE-2022-24710 Medium 5.4 Cross-site Scripting in Weblate 0.8%