# cve.now: Weblateorg

The newest entries naming Weblateorg as an affected vendor (up to 200), of 48 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-86035](https://cve.now/CVE-2026-86035.md): Weblate: Mercurial argument injection via repository filenames allows authenticated command execution (CVSS 8.5)
- [CVE-2026-62364](https://cve.now/CVE-2026-62364.md): wlc may disclose API tokens to project-configured URLs (CVSS 2.3)
- [CVE-2026-77573](https://cve.now/CVE-2026-77573.md): Weblate: DNS rebinding in VCS operations allows server-side request forgery (CVSS 3.5)
- [CVE-2026-77507](https://cve.now/CVE-2026-77507.md): Weblate: Object-scoped RSS feeds disclose private change history to unauthorized users (CVSS 5.3)
- [CVE-2026-62326](https://cve.now/CVE-2026-62326.md): Weblate Has Uncontrolled Resource Consumption via (CVSS 6.5)
- [CVE-2026-62249](https://cve.now/CVE-2026-62249.md): Weblate: Restricted-component change history leaked to non-member project users through the nested \`GET /api/projects/{slug}/changes/\` endpoint (CVSS 4.3)
- [CVE-2026-61792](https://cve.now/CVE-2026-61792.md): Weblate path traversal allows a project administrator to read arbitrary files via App store metadata download (Incomplete Fix of CVE-2026-34242) (CVSS 7.7)
- [CVE-2026-61790](https://cve.now/CVE-2026-61790.md): Weblate: Team-enforced 2FA is bypassed for global permissions (CVSS 4.4)
- [CVE-2026-55228](https://cve.now/CVE-2026-55228.md): Weblate:: WebIDOR in GroupViewSet allows authenticated project manager to gain unauthorized read access to any private project (CVSS 8.1)
- [CVE-2026-55227](https://cve.now/CVE-2026-55227.md): Observable object existence disclosure in private Weblate projects via globally scoped object lookups (CVSS 4.3)
- [CVE-2026-77508](https://cve.now/CVE-2026-77508.md): Weblate: Unverified REST API email changes (CVSS 3.5)
- [CVE-2026-45106](https://cve.now/CVE-2026-45106.md): Weblate: Stored HTML injection in editor search preview (CVSS 4.6)
- [CVE-2026-50127](https://cve.now/CVE-2026-50127.md): Weblate SSRF: outbound URL guard misses the NAT64 well-known prefix (64:ff9b::/96) (CVSS 5.9)
- [CVE-2026-42150](https://cve.now/CVE-2026-42150.md): wlc: print\_html outputs API data without HTML escaping, enabling stored XSS (CVSS 5.1)
- [CVE-2026-44264](https://cve.now/CVE-2026-44264.md): Weblate is vulnerable to XSS via crafted Markdown (CVSS 4.3)
- [CVE-2026-44263](https://cve.now/CVE-2026-44263.md): Weblate: Private Translation Enumeration via Screenshot API (CVSS 4.3)
- [CVE-2026-41519](https://cve.now/CVE-2026-41519.md): Weblate's API Token Not Invalidated on Password Change (CVSS 4.2)
- [CVE-2026-41654](https://cve.now/CVE-2026-41654.md): Weblate is Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate\_repo\_url (CVSS 5.3)
- [CVE-2026-40256](https://cve.now/CVE-2026-40256.md): Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision (CVSS 5.0)
- [CVE-2026-39845](https://cve.now/CVE-2026-39845.md): Weblate: SSRF via the webhook add-on using unprotected fetch\_url() (CVSS 4.1)
- [CVE-2026-34393](https://cve.now/CVE-2026-34393.md): Weblate: Privilege escalation in the user API endpoint (CVSS 8.8)
- [CVE-2026-34244](https://cve.now/CVE-2026-34244.md): Weblate: SSRF via Project-Level Machinery Configuration (CVSS 5.0)
- [CVE-2026-34242](https://cve.now/CVE-2026-34242.md): Weblate: Arbitrary File Read via Symlink (CVSS 7.7)
- [CVE-2026-33440](https://cve.now/CVE-2026-33440.md): Weblate: Authenticated SSRF via redirect bypass of ALLOWED\_ASSET\_DOMAINS in screenshot URL uploads (CVSS 5.0)
- [CVE-2026-33435](https://cve.now/CVE-2026-33435.md): Weblate: Remote code execution during backup restoration (CVSS 8.1)
- [CVE-2026-33220](https://cve.now/CVE-2026-33220.md): Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository (CVSS 6.8)
- [CVE-2026-33214](https://cve.now/CVE-2026-33214.md): Weblate has improper access control for the translation memory API (CVSS 4.3)
- [CVE-2026-33212](https://cve.now/CVE-2026-33212.md): Weblate: Improper access control for pending tasks in API (CVSS 3.1)
- [CVE-2026-27457](https://cve.now/CVE-2026-27457.md): Weblate: Missing access control for the AddonViewSet API exposes all addon configurations (CVSS 4.3)
- [CVE-2026-24126](https://cve.now/CVE-2026-24126.md): Weblate has an argument injection in management console (CVSS 6.6)
- [CVE-2026-23535](https://cve.now/CVE-2026-23535.md): wlc Path traversal: Unsanitized API slugs in download command (CVSS 8.1)
- [CVE-2026-21889](https://cve.now/CVE-2026-21889.md): Weblate leaks information via screenshots (CVSS 2.3)
- [CVE-2026-22251](https://cve.now/CVE-2026-22251.md): wlc may leak API keys due to an insecure API key configuration (CVSS 5.3)
- [CVE-2026-22250](https://cve.now/CVE-2026-22250.md): wlc can skip SSL verification (CVSS 2.5)
- [CVE-2025-68398](https://cve.now/CVE-2025-68398.md): Weblate has git config file overwrite vulnerability that leads to remote code execution (CVSS 9.1)
- [CVE-2025-68279](https://cve.now/CVE-2025-68279.md): Weblate has an arbitrary file read via symbolic links (CVSS 7.7)
- [CVE-2025-67715](https://cve.now/CVE-2025-67715.md): Weblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR) (CVSS 4.3)
- [CVE-2025-67492](https://cve.now/CVE-2025-67492.md): Weblate's over‑permissive webhook endpoint enables mass repository updates and component enumeration (CVSS 5.3)
- [CVE-2025-66407](https://cve.now/CVE-2025-66407.md): Weblate has Server-Side Request Forgery vulnerability (CVSS 5.0)
- [CVE-2025-64725](https://cve.now/CVE-2025-64725.md): Weblate has improper validation upon invitation acceptance (CVSS 1.0)
- [CVE-2025-64326](https://cve.now/CVE-2025-64326.md): Weblate leaks the IP of project members inviting users to assume reviewer roles in Audit log (CVSS 2.6)
- [CVE-2025-61587](https://cve.now/CVE-2025-61587.md): Weblate integration with Anubis can lead to Open Redirect via redir parameter (CVSS 2.1)
- [CVE-2025-58352](https://cve.now/CVE-2025-58352.md): Weblate has long session expiry times during second factor verification (CVSS 2.1)
- [CVE-2025-49134](https://cve.now/CVE-2025-49134.md): Weblate exposes personal IP address via e-mail (CVSS 2.1)
- [CVE-2025-47951](https://cve.now/CVE-2025-47951.md): Weblate lacks rate limiting when verifying second factor (CVSS 4.9)
- [CVE-2025-32021](https://cve.now/CVE-2025-32021.md): Weblate VCS credentials included in URL parameters are potentially logged and saved into browser history as plaintext (CVSS 2.2)
- [CVE-2024-39303](https://cve.now/CVE-2024-39303.md): Weblate vulnerabler to improper sanitization of project backups (CVSS 4.4)
- [CVE-2022-24710](https://cve.now/CVE-2022-24710.md): Cross-site Scripting in Weblate (CVSS 5.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/weblateorg
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.