WeblateOrg

Records50All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high10CVSS 7.0–8.9

Exploited now

WeblateOrg records in CISA KEV

No WeblateOrg vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Weblate 33 records HIGH Wlc 4 records LOW

Records

50 records

TI-2025-23145 CVE-2025-32021 · GHSA-m67m-3p5g-cw9j

Weblate VCS credentials included in URL parameters are potentially logged and saved into browser history as plaintext

HIGH 66

Weblate is a web based localization tool.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00379 Published 2025-04-15 Fixed in 5.11 CWE-598

TI-2025-38033 CVE-2025-61587

Weblate integration with Anubis can lead to Open Redirect via redir parameter

MEDIUM 44

Weblate is a web based localization tool.

CVSS 4.0LOW 2.1 Network No auth User interaction EPSS 0.00391 Published 2025-10-01 Fixed in 5.13.3 CWE-1395

TI-2022-07893 CVE-2022-23915 · GHSA-3872-f48p-pxqj

Remote code execution (RCE) in Weblate

MEDIUM 44

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.03099 Published 2022-03-04 Fixed in 4.11.1 CWE-88

TI-2025-41967 CVE-2025-68398 · GHSA-8vcg-cfxj-p5m3

Weblate has git config file overwrite vulnerability that leads to remote code execution

MEDIUM 43

Weblate is a web based localization tool.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00792 Published 2025-12-18 Fixed in 5.15.1 CWE-20

TI-2026-26679 CVE-2026-34393 · GHSA-3382-gw9x-477v

Weblate: Privilege escalation in the user API endpoint

MEDIUM 40

Weblate is a web based localization tool.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00391 Published 2026-04-15 Fixed in 5.17 CWE-269

TI-2026-19444 CVE-2026-24126 · GHSA-33fm-6gp7-4p47

Weblate has an argument injection in management console

MEDIUM 40

Weblate is a web based localization tool.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00519 Published 2026-02-18 Fixed in 5.16.0 CWE-88

TI-2026-58863 CVE-2026-86035

Weblate: Mercurial argument injection via repository filenames allows authenticated command execution

LOW 39

Weblate is a web-based continuous localization platform used to manage software translations.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00464 Published 2026-09-29 Fixed in 2026.8 CWE-78

TI-2026-39905 CVE-2026-55228 · GHSA-2q2q-jr9g-v9rf

Authorization bypass in WeblateOrg weblate

LOW 38

Weblate is a web-based continuous localization platform used to manage software translations.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00448 Published 2026-08-26 Fixed in 2026.7 CWE-639

TI-2026-25832 CVE-2026-33435 · GHSA-558g-h753-6m33

Weblate: Remote code execution during backup restoration

LOW 38

Weblate is a web based localization tool.

CVSS 3.1HIGH 8.1 Network High privileges No interaction EPSS 0.00708 Published 2026-04-15 Fixed in 5.17 CWE-23

TI-2026-18959 CVE-2026-23535 · GHSA-mmwx-79f6-67jg

wlc Path traversal: Unsanitized API slugs in download command

LOW 37

wlc is a Weblate command-line client using Weblate's REST API.

CVSS 3.1HIGH 8.1 Network Low privileges User interaction EPSS 0.00387 Published 2026-01-16 Fixed in 1.17.2 CWE-22

TI-2026-44230 CVE-2026-61792

Path traversal in WeblateOrg weblate

LOW 34

Weblate is a web-based continuous localization platform used to manage software translations.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00586 Published 2026-08-26 Fixed in 2026.7 CWE-22

TI-2026-26537 CVE-2026-34242 · GHSA-hv99-mxm5-q397

Weblate: Arbitrary File Read via Symlink

LOW 34

Weblate is a web based localization tool.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00465 Published 2026-04-15 Fixed in 5.17 CWE-200

TI-2025-41855 CVE-2025-68279 · GHSA-g925-f788-4jh7

Weblate has an arbitrary file read via symbolic links

LOW 34

Weblate is a web based localization tool.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00412 Published 2025-12-18 Fixed in 5.15.1 CWE-200

TI-2026-54040 CVE-2026-77507

Weblate: Object-scoped RSS feeds disclose private change history to unauthorized users

LOW 30

Weblate is a web-based continuous localization platform used to manage software translations.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0043 Published 2026-08-26 Fixed in 2026.8 CWE-200

TI-2026-30172 CVE-2026-41654 · GHSA-cwcx-382v-8m9g

Weblate is Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url

LOW 30

Weblate is a web based localization tool.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00371 Published 2026-05-07 Fixed in 5.17.1 CWE-20

TI-2026-25641 CVE-2026-33220 · GHSA-mqph-7h49-hqfm

Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository

LOW 30

Weblate is a web based localization tool.

CVSS 3.1MEDIUM 6.8 Network Low privileges User interaction EPSS 0.00323 Published 2026-04-15 Fixed in 5.17 CWE-200

TI-2025-41251 CVE-2025-67492 · GHSA-pj86-258h-qrvf

Weblate's over‑permissive webhook endpoint enables mass repository updates and component enumeration

LOW 30

Weblate is a web based localization tool.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00255 Published 2025-12-16 Fixed in 5.15 CWE-1286

TI-2026-44498 CVE-2026-62326

Weblate Has Uncontrolled Resource Consumption via

LOW 29

Weblate is a web-based continuous localization platform used to manage software translations.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00502 Published 2026-08-26 Fixed in 2026.7 CWE-400

TI-2017-03552 CVE-2017-5537 · GHSA-j24g-gm76-j829

The password reset form in Weblate before 2.10.1 provides different error messages…

LOW 29

The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote attackers to enumerate user accounts via a seri…

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.02351 Published 2017-03-15 Fixed in 2.10.1 CWE-200

TI-2025-40844 CVE-2025-66407 · GHSA-hfpv-mc5v-p9mm

Weblate has Server-Side Request Forgery vulnerability

LOW 28

Weblate is a web based localization tool.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.0024 Published 2025-12-15 Fixed in 5.15 CWE-352

TI-2026-36898 CVE-2026-50127 · GHSA-vmfc-9982-2m45

Weblate SSRF: outbound URL guard misses the NAT64 well-known prefix (64:ff9b::/96)

LOW 26

Weblate is a web based localization tool.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00308 Published 2026-06-10 Fixed in 2026.6 CWE-918

TI-2022-08525 CVE-2022-24710 · GHSA-6jp6-9rf9-gc66

Cross-site Scripting in Weblate

LOW 26

Weblate is a copyleft software web-based continuous localization system.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00753 Published 2022-02-25 Fixed in 4.11 CWE-79

TI-2026-30102 CVE-2026-41519 · GHSA-6j8j-4qp3-36p2

Weblate's API Token Not Invalidated on Password Change

LOW 24

Weblate is a web based localization tool.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.0027 Published 2026-05-07 Fixed in 5.17.1 CWE-613

TI-2026-17861 CVE-2026-22251 · GHSA-9rp8-h4g8-8766

wlc may leak API keys due to an insecure API key configuration

LOW 24

wlc is a Weblate command-line client using Weblate's REST API.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00189 Published 2026-01-12 Fixed in 1.17.0 CWE-200

TI-2026-17860 CVE-2026-22250 · GHSA-2mmv-7rrp-g8xh

wlc can skip SSL verification

LOW 24

wlc is a Weblate command-line client using Weblate's REST API.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00154 Published 2026-01-12 Fixed in 1.17.0 CWE-295

Open these records in search →