Weblateorg vulnerabilities
48 CVEs and advisories name Weblateorg as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-23535wlc Path traversal: Unsanitized API slugs in download command
- CVE-2026-21889Weblate leaks information via screenshots
- CVE-2026-22251wlc may leak API keys due to an insecure API key configuration
- CVE-2026-22250wlc can skip SSL verification
- CVE-2025-68398Weblate has git config file overwrite vulnerability that leads to remote code execution
- CVE-2025-68279Weblate has an arbitrary file read via symbolic links
- CVE-2025-67715Weblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR)
- CVE-2025-67492Weblate's over‑permissive webhook endpoint enables mass repository updates and component enumeration
- CVE-2025-66407Weblate has Server-Side Request Forgery vulnerability
- CVE-2025-64725Weblate has improper validation upon invitation acceptance
- CVE-2025-64326Weblate leaks the IP of project members inviting users to assume reviewer roles in Audit log
- CVE-2025-61587Weblate integration with Anubis can lead to Open Redirect via redir parameter
- CVE-2025-58352Weblate has long session expiry times during second factor verification
- CVE-2025-49134Weblate exposes personal IP address via e-mail
- CVE-2025-47951Weblate lacks rate limiting when verifying second factor
- CVE-2025-32021Weblate VCS credentials included in URL parameters are potentially logged and saved into browser history as plaintext
- CVE-2024-39303Weblate vulnerabler to improper sanitization of project backups
- CVE-2022-24710Cross-site Scripting in Weblate