# weblate (PyPI) vulnerabilities 37 known vulnerabilities (1 critical, 6 high, 21 medium, 8 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Weekly downloads: 4,516 - Dependents: 1 - Registry: https://pypi.org/project/weblate/ ## Advisories (37) ### [CVE-2026-55228](https://cve.now/CVE-2026-55228): Weblate:: WebIDOR in GroupViewSet allows authenticated project manager to gain unauthorized read access to any private project - Severity: High 8.1 - Published: Aug 26, 2026 - Affected: fixed in 2026.7. ### [CVE-2026-55227](https://cve.now/CVE-2026-55227): Observable object existence disclosure in private Weblate projects via globally scoped object lookups - Severity: Medium 4.3 - Published: Aug 26, 2026 - Affected: fixed in 2026.7. ### [CVE-2026-45106](https://cve.now/CVE-2026-45106): Weblate: Stored HTML injection in editor search preview - Severity: Medium 4.6 - Published: Jun 10, 2026 - Affected: fixed in 2026.5. ### [CVE-2026-50127](https://cve.now/CVE-2026-50127): Weblate SSRF: outbound URL guard misses the NAT64 well-known prefix (64:ff9b::/96) - Severity: Medium 5.9 - Published: Jun 10, 2026 - Affected: from 5.15, fixed in 2026.6. ### [CVE-2026-44264](https://cve.now/CVE-2026-44264): Weblate is vulnerable to XSS via crafted Markdown - Severity: Medium 4.3 - Published: May 7, 2026 - Affected: fixed in 5.17.1. ### [CVE-2026-44263](https://cve.now/CVE-2026-44263): Weblate: Private Translation Enumeration via Screenshot API - Severity: Medium 4.3 - Published: May 7, 2026 - Affected: fixed in 5.17.1. ### [CVE-2026-41519](https://cve.now/CVE-2026-41519): Weblate's API Token Not Invalidated on Password Change - Severity: Medium 4.2 - Published: May 7, 2026 - Affected: fixed in 5.17.1. ### [CVE-2026-41654](https://cve.now/CVE-2026-41654): Weblate is Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate\_repo\_url - Severity: Medium 5.3 - Published: May 7, 2026 - Affected: fixed in 5.17.1. ### [CVE-2026-40256](https://cve.now/CVE-2026-40256): Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision - Severity: Medium 5.0 - Published: Apr 15, 2026 - Affected: fixed in 5.17. ### [CVE-2026-39845](https://cve.now/CVE-2026-39845): Weblate: SSRF via the webhook add-on using unprotected fetch\_url() - Severity: Medium 4.1 - Published: Apr 15, 2026 - Affected: fixed in 5.17. ### [CVE-2026-34393](https://cve.now/CVE-2026-34393): Weblate: Privilege escalation in the user API endpoint - Severity: High 8.8 - Published: Apr 15, 2026 - Affected: fixed in 5.17. ### [CVE-2026-34244](https://cve.now/CVE-2026-34244): Weblate: SSRF via Project-Level Machinery Configuration - Severity: Medium 5.0 - Published: Apr 15, 2026 - Affected: fixed in 5.17. ### [CVE-2026-34242](https://cve.now/CVE-2026-34242): Weblate: Arbitrary File Read via Symlink - Severity: High 7.7 - Published: Apr 15, 2026 - Affected: fixed in 5.17. ### [CVE-2026-33440](https://cve.now/CVE-2026-33440): Weblate: Authenticated SSRF via redirect bypass of ALLOWED\_ASSET\_DOMAINS in screenshot URL uploads - Severity: Medium 5.0 - Published: Apr 15, 2026 - Affected: fixed in 5.17. ### [CVE-2026-33435](https://cve.now/CVE-2026-33435): Weblate: Remote code execution during backup restoration - Severity: High 8.1 - Published: Apr 15, 2026 - Affected: fixed in 5.17. ### [CVE-2026-33220](https://cve.now/CVE-2026-33220): Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository - Severity: Medium 6.8 - Published: Apr 15, 2026 - Affected: fixed in 5.17. ### [CVE-2026-33214](https://cve.now/CVE-2026-33214): Weblate has improper access control for the translation memory API - Severity: Medium 4.3 - Published: Apr 15, 2026 - Affected: fixed in 5.17. ### [CVE-2026-33212](https://cve.now/CVE-2026-33212): Weblate: Improper access control for pending tasks in API - Severity: Low 3.1 - Published: Apr 15, 2026 - Affected: fixed in 5.17. ### [CVE-2026-27457](https://cve.now/CVE-2026-27457): Weblate: Missing access control for the AddonViewSet API exposes all addon configurations - Severity: Medium 4.3 - Published: Feb 26, 2026 - Affected: fixed in 5.16.1. ### [CVE-2026-24126](https://cve.now/CVE-2026-24126): Weblate has an argument injection in management console - Severity: Medium 6.6 - Published: Feb 18, 2026 - Affected: fixed in 5.16.0; fixed in 5.16. ### [CVE-2026-21889](https://cve.now/CVE-2026-21889): Weblate leaks information via screenshots - Severity: Low 2.3 - Published: Jan 14, 2026 - Affected: fixed in 5.15.2. ### [CVE-2025-68398](https://cve.now/CVE-2025-68398): Weblate has git config file overwrite vulnerability that leads to remote code execution - Severity: Critical 9.1 - Published: Dec 18, 2025 - Affected: fixed in 5.15.1. ### [CVE-2025-68279](https://cve.now/CVE-2025-68279): Weblate has an arbitrary file read via symbolic links - Severity: High 7.7 - Published: Dec 18, 2025 - Affected: fixed in 5.15.1. ### [CVE-2025-67715](https://cve.now/CVE-2025-67715): Weblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR) - Severity: Medium 4.3 - Published: Dec 16, 2025 - Affected: fixed in 5.15. ### [CVE-2025-67492](https://cve.now/CVE-2025-67492): Weblate's over‑permissive webhook endpoint enables mass repository updates and component enumeration - Severity: Medium 5.3 - Published: Dec 16, 2025 - Affected: fixed in 5.15. ### [CVE-2025-66407](https://cve.now/CVE-2025-66407): Weblate has Server-Side Request Forgery vulnerability - Severity: Medium 5.0 - Published: Dec 15, 2025 - Affected: fixed in 5.15. ### [CVE-2025-64725](https://cve.now/CVE-2025-64725): Weblate has improper validation upon invitation acceptance - Severity: Low 1.0 - Published: Dec 15, 2025 - Affected: fixed in 5.15. ### [CVE-2025-64326](https://cve.now/CVE-2025-64326): Weblate leaks the IP of project members inviting users to assume reviewer roles in Audit log - Severity: Low 2.6 - Published: Nov 6, 2025 - Affected: fixed in 5.14.1. ### [CVE-2025-61587](https://cve.now/CVE-2025-61587): Weblate integration with Anubis can lead to Open Redirect via redir parameter - Severity: Low 2.1 - Published: Oct 1, 2025 - Affected: fixed in 5.13.3. ### [CVE-2025-58352](https://cve.now/CVE-2025-58352): Weblate has long session expiry times during second factor verification - Severity: Low 2.1 - Published: Sep 4, 2025 - Affected: fixed in 5.13.1. ### [CVE-2025-49134](https://cve.now/CVE-2025-49134): Weblate exposes personal IP address via e-mail - Severity: Low 2.1 - Published: Jun 16, 2025 - Affected: fixed in 5.12. ### [CVE-2025-47951](https://cve.now/CVE-2025-47951): Weblate lacks rate limiting when verifying second factor - Severity: Medium 4.9 - Published: Jun 16, 2025 - Affected: fixed in 5.12. ### [CVE-2025-32021](https://cve.now/CVE-2025-32021): Weblate VCS credentials included in URL parameters are potentially logged and saved into browser history as plaintext - Severity: Low 2.2 - Published: Apr 15, 2025 - Affected: fixed in 5.11; fixed in 5.11. ### [CVE-2024-39303](https://cve.now/CVE-2024-39303): Weblate vulnerabler to improper sanitization of project backups - Severity: Medium 4.4 - Published: Jul 1, 2024 - Affected: from 4.14, fixed in 5.6.2. ### [CVE-2022-23915](https://cve.now/CVE-2022-23915): Remote Code Execution (RCE) - Severity: High 7.2 - Published: Mar 4, 2022 - Affected: fixed in 4.11.1. ### [CVE-2022-24710](https://cve.now/CVE-2022-24710): Cross-site Scripting in Weblate - Severity: Medium 5.4 - Published: Feb 25, 2022 - Affected: fixed in 4.11. ### [CVE-2017-5537](https://cve.now/CVE-2017-5537): The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated… - Severity: Unrated - Published: Mar 15, 2017 - Affected: fixed in 2.10.1; fixed in 2.10.1. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/weblate Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.