- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 37 · 1 critical, 6 high, 21 medium, 8 low
- Weekly downloads
- 4,516
- Dependents
- 1
- Registry
- PyPI
Advisories 37
- CVE-2026-55228High 8.1
Weblate:: WebIDOR in GroupViewSet allows authenticated project manager to gain unauthorized read access to any private project
Affected: fixed in 2026.7.
- CVE-2026-55227Medium 4.3
Observable object existence disclosure in private Weblate projects via globally scoped object lookups
Affected: fixed in 2026.7.
- CVE-2026-45106Medium 4.6
Weblate: Stored HTML injection in editor search preview
Affected: fixed in 2026.5.
- CVE-2026-50127Medium 5.9
Weblate SSRF: outbound URL guard misses the NAT64 well-known prefix (64:ff9b::/96)
Affected: from 5.15, fixed in 2026.6.
- CVE-2026-44264Medium 4.3
Weblate is vulnerable to XSS via crafted Markdown
Affected: fixed in 5.17.1.
- CVE-2026-44263Medium 4.3
Weblate: Private Translation Enumeration via Screenshot API
Affected: fixed in 5.17.1.
- CVE-2026-41519Medium 4.2
Weblate's API Token Not Invalidated on Password Change
Affected: fixed in 5.17.1.
- CVE-2026-41654Medium 5.3
Weblate is Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url
Affected: fixed in 5.17.1.
- CVE-2026-40256Medium 5.0
Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision
Affected: fixed in 5.17.
- CVE-2026-39845Medium 4.1
Weblate: SSRF via the webhook add-on using unprotected fetch_url()
Affected: fixed in 5.17.
- CVE-2026-34393High 8.8
Weblate: Privilege escalation in the user API endpoint
Affected: fixed in 5.17.
- CVE-2026-34244Medium 5.0
Weblate: SSRF via Project-Level Machinery Configuration
Affected: fixed in 5.17.
- CVE-2026-34242High 7.7
Weblate: Arbitrary File Read via Symlink
Affected: fixed in 5.17.
- CVE-2026-33440Medium 5.0
Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads
Affected: fixed in 5.17.
- CVE-2026-33435High 8.1
Weblate: Remote code execution during backup restoration
Affected: fixed in 5.17.
Show all 37 advisoriesShow fewer advisories
- CVE-2026-33220Medium 6.8
Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository
Affected: fixed in 5.17.
- CVE-2026-33214Medium 4.3
Weblate has improper access control for the translation memory API
Affected: fixed in 5.17.
- CVE-2026-33212Low 3.1
Weblate: Improper access control for pending tasks in API
Affected: fixed in 5.17.
- CVE-2026-27457Medium 4.3
Weblate: Missing access control for the AddonViewSet API exposes all addon configurations
Affected: fixed in 5.16.1.
- CVE-2026-24126Medium 6.6
Weblate has an argument injection in management console
Affected: fixed in 5.16.0; fixed in 5.16.
- CVE-2026-21889Low 2.3
Weblate leaks information via screenshots
Affected: fixed in 5.15.2.
- CVE-2025-68398Critical 9.1
Weblate has git config file overwrite vulnerability that leads to remote code execution
Affected: fixed in 5.15.1.
- CVE-2025-68279High 7.7
Weblate has an arbitrary file read via symbolic links
Affected: fixed in 5.15.1.
- CVE-2025-67715Medium 4.3
Weblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR)
Affected: fixed in 5.15.
- CVE-2025-67492Medium 5.3
Weblate's over‑permissive webhook endpoint enables mass repository updates and component enumeration
Affected: fixed in 5.15.
- CVE-2025-66407Medium 5.0
Weblate has Server-Side Request Forgery vulnerability
Affected: fixed in 5.15.
- CVE-2025-64725Low 1.0
Weblate has improper validation upon invitation acceptance
Affected: fixed in 5.15.
- CVE-2025-64326Low 2.6
Weblate leaks the IP of project members inviting users to assume reviewer roles in Audit log
Affected: fixed in 5.14.1.
- CVE-2025-61587Low 2.1
Weblate integration with Anubis can lead to Open Redirect via redir parameter
Affected: fixed in 5.13.3.
- CVE-2025-58352Low 2.1
Weblate has long session expiry times during second factor verification
Affected: fixed in 5.13.1.
- CVE-2025-49134Low 2.1
Weblate exposes personal IP address via e-mail
Affected: fixed in 5.12.
- CVE-2025-47951Medium 4.9
Weblate lacks rate limiting when verifying second factor
Affected: fixed in 5.12.
- CVE-2025-32021Low 2.2
Weblate VCS credentials included in URL parameters are potentially logged and saved into browser history as plaintext
Affected: fixed in 5.11; fixed in 5.11.
- CVE-2024-39303Medium 4.4
Weblate vulnerabler to improper sanitization of project backups
Affected: from 4.14, fixed in 5.6.2.
- CVE-2022-23915High 7.2
Remote Code Execution (RCE)
Affected: fixed in 4.11.1.
- CVE-2022-24710Medium 5.4
Cross-site Scripting in Weblate
Affected: fixed in 4.11.
- CVE-2017-5537Unrated
The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated…
Affected: fixed in 2.10.1; fixed in 2.10.1.