Weblateorg vulnerabilities
48 CVEs and advisories name Weblateorg as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-86035Weblate: Mercurial argument injection via repository filenames allows authenticated command execution
- CVE-2026-62364wlc may disclose API tokens to project-configured URLs
- CVE-2026-77573Weblate: DNS rebinding in VCS operations allows server-side request forgery
- CVE-2026-77507Weblate: Object-scoped RSS feeds disclose private change history to unauthorized users
- CVE-2026-62326Weblate Has Uncontrolled Resource Consumption via
- CVE-2026-62249Weblate: Restricted-component change history leaked to non-member project users through the nested `GET /api/projects/{slug}/changes/` endpoint
- CVE-2026-61792Weblate path traversal allows a project administrator to read arbitrary files via App store metadata download (Incomplete Fix of CVE-2026-34242)
- CVE-2026-61790Weblate: Team-enforced 2FA is bypassed for global permissions
- CVE-2026-55228Weblate:: WebIDOR in GroupViewSet allows authenticated project manager to gain unauthorized read access to any private project
- CVE-2026-55227Observable object existence disclosure in private Weblate projects via globally scoped object lookups
- CVE-2026-77508Weblate: Unverified REST API email changes
- CVE-2026-45106Weblate: Stored HTML injection in editor search preview
- CVE-2026-50127Weblate SSRF: outbound URL guard misses the NAT64 well-known prefix (64:ff9b::/96)
- CVE-2026-42150wlc: print_html outputs API data without HTML escaping, enabling stored XSS
- CVE-2026-44264Weblate is vulnerable to XSS via crafted Markdown
- CVE-2026-44263Weblate: Private Translation Enumeration via Screenshot API
- CVE-2026-41519Weblate's API Token Not Invalidated on Password Change
- CVE-2026-41654Weblate is Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url
- CVE-2026-40256Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision
- CVE-2026-39845Weblate: SSRF via the webhook add-on using unprotected fetch_url()
- CVE-2026-34393Weblate: Privilege escalation in the user API endpoint
- CVE-2026-34244Weblate: SSRF via Project-Level Machinery Configuration
- CVE-2026-34242Weblate: Arbitrary File Read via Symlink
- CVE-2026-33440Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads
- CVE-2026-33435Weblate: Remote code execution during backup restoration
- CVE-2026-33220Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository
- CVE-2026-33214Weblate has improper access control for the translation memory API
- CVE-2026-33212Weblate: Improper access control for pending tasks in API
- CVE-2026-27457Weblate: Missing access control for the AddonViewSet API exposes all addon configurations
- CVE-2026-24126Weblate has an argument injection in management console