Vulnerabilities

TI-2026-32240 CVE-2026-44264 · GHSA-5cmv-3rc4-7279

Weblate is vulnerable to XSS via crafted Markdown

LOW 20

Weblate is a web based localization tool.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00275 Published 2026-05-07 Fixed in 5.17.1 CWE-80

TI-2026-32239 CVE-2026-44263 · GHSA-gcg5-86jr-f7jg

Weblate: Private Translation Enumeration via Screenshot API

LOW 20

Weblate is a web based localization tool.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00338 Published 2026-05-07 Fixed in 5.17.1 CWE-203

TI-2026-30102 CVE-2026-41519 · GHSA-6j8j-4qp3-36p2

Weblate's API Token Not Invalidated on Password Change

LOW 24

Weblate is a web based localization tool.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.0027 Published 2026-05-07 Fixed in 5.17.1 CWE-613

TI-2026-30172 CVE-2026-41654 · GHSA-cwcx-382v-8m9g

Weblate is Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url

LOW 30

Weblate is a web based localization tool.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00371 Published 2026-05-07 Fixed in 5.17.1 CWE-20

TI-2026-29050 CVE-2026-40256 · GHSA-ffgh-3jrf-8wvh

Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision

LOW 23

Weblate is a web based localization tool.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00324 Published 2026-04-15 Fixed in 5.17 CWE-22

TI-2026-28727 CVE-2026-39845 · GHSA-f8hv-g549-hwg2

Weblate: SSRF via the webhook add-on using unprotected fetch_url()

LOW 19

Weblate is a web based localization tool.

CVSS 3.1MEDIUM 4.1 Network High privileges No interaction EPSS 0.00275 Published 2026-04-15 Fixed in 5.17 CWE-918

TI-2026-26679 CVE-2026-34393 · GHSA-3382-gw9x-477v

Weblate: Privilege escalation in the user API endpoint

MEDIUM 40

Weblate is a web based localization tool.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00391 Published 2026-04-15 Fixed in 5.17 CWE-269

TI-2026-26539 CVE-2026-34244 · GHSA-xrwr-fcw6-fmq8

Weblate: SSRF via Project-Level Machinery Configuration

LOW 22

Weblate is a web based localization tool.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00254 Published 2026-04-15 Fixed in 517, 5.17 CWE-200

TI-2026-26537 CVE-2026-34242 · GHSA-hv99-mxm5-q397

Weblate: Arbitrary File Read via Symlink

LOW 34

Weblate is a web based localization tool.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00465 Published 2026-04-15 Fixed in 5.17 CWE-200

TI-2026-25837 CVE-2026-33440 · GHSA-5fhx-9jwj-867m

Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads

LOW 22

Weblate is a web based localization tool.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.0024 Published 2026-04-15 Fixed in 5.17 CWE-918

TI-2026-25832 CVE-2026-33435 · GHSA-558g-h753-6m33

Weblate: Remote code execution during backup restoration

LOW 38

Weblate is a web based localization tool.

CVSS 3.1HIGH 8.1 Network High privileges No interaction EPSS 0.00708 Published 2026-04-15 Fixed in 5.17 CWE-23

TI-2026-25641 CVE-2026-33220 · GHSA-mqph-7h49-hqfm

Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository

LOW 30

Weblate is a web based localization tool.

CVSS 3.1MEDIUM 6.8 Network Low privileges User interaction EPSS 0.00323 Published 2026-04-15 Fixed in 5.17 CWE-200

TI-2026-25635 CVE-2026-33214 · GHSA-mpf5-3vph-q75r

Weblate has improper access control for the translation memory API

LOW 20

Weblate is a web based localization tool.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00236 Published 2026-04-15 Fixed in 5.17 CWE-862

TI-2026-25633 CVE-2026-33212 · GHSA-vj45-x3pj-f4w4

Weblate: Improper access control for pending tasks in API

LOW 15

Weblate is a web based localization tool.

CVSS 3.1LOW 3.1 Network Low privileges No interaction EPSS 0.00221 Published 2026-04-15 Fixed in 5.17 CWE-284

TI-2026-21864 CVE-2026-27457 · GHSA-wppc-7cq7-cgfv

Weblate: Missing access control for the AddonViewSet API exposes all addon configurations

LOW 20

Weblate is a web based localization tool.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00348 Published 2026-02-26 Fixed in 5.16.1 CWE-200

TI-2026-19444 CVE-2026-24126 · GHSA-33fm-6gp7-4p47

Weblate has an argument injection in management console

MEDIUM 40

Weblate is a web based localization tool.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00519 Published 2026-02-18 Fixed in 5.16.0 CWE-88

TI-2026-17590 CVE-2026-21889 · GHSA-3g2f-4rjg-9385

Weblate leaks information via screenshots

LOW 12

Weblate is a web based localization tool.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00387 Published 2026-01-14 Fixed in 5.15.2 CWE-284

TI-2025-41967 CVE-2025-68398 · GHSA-8vcg-cfxj-p5m3

Weblate has git config file overwrite vulnerability that leads to remote code execution

MEDIUM 43

Weblate is a web based localization tool.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00792 Published 2025-12-18 Fixed in 5.15.1 CWE-20

TI-2025-41855 CVE-2025-68279 · GHSA-g925-f788-4jh7

Weblate has an arbitrary file read via symbolic links

LOW 34

Weblate is a web based localization tool.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00412 Published 2025-12-18 Fixed in 5.15.1 CWE-200

TI-2025-41411 CVE-2025-67715 · GHSA-3pmh-24wp-xpf4

Weblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR)

LOW 20

Weblate is a web based localization tool.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00272 Published 2025-12-16 Fixed in 5.15 CWE-284

TI-2025-41251 CVE-2025-67492 · GHSA-pj86-258h-qrvf

Weblate's over‑permissive webhook endpoint enables mass repository updates and component enumeration

LOW 30

Weblate is a web based localization tool.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00255 Published 2025-12-16 Fixed in 5.15 CWE-1286

TI-2025-40844 CVE-2025-66407 · GHSA-hfpv-mc5v-p9mm

Weblate has Server-Side Request Forgery vulnerability

LOW 28

Weblate is a web based localization tool.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.0024 Published 2025-12-15 Fixed in 5.15 CWE-352

TI-2025-40070 CVE-2025-64725 · GHSA-m6hq-f4w9-qrjj

Weblate has improper validation upon invitation acceptance

LOW 7

Weblate is a web based localization tool.

CVSS 4.0LOW 1.0 Local Low privileges User interaction EPSS 0.00349 Published 2025-12-15 Fixed in 5.15 CWE-286

TI-2025-39761 CVE-2025-64326 · GHSA-gr35-vpx2-qxhc

Weblate leaks the IP of project members inviting users to assume reviewer roles in Audit log

LOW 16

Weblate is a web based localization tool.

CVSS 3.1LOW 3.5 Network Low privileges User interaction EPSS 0.00199 Published 2025-11-06 Fixed in 5.14.1 CWE-212

TI-2025-38033 CVE-2025-61587

Weblate integration with Anubis can lead to Open Redirect via redir parameter

MEDIUM 44

Weblate is a web based localization tool.

CVSS 4.0LOW 2.1 Network No auth User interaction EPSS 0.00391 Published 2025-10-01 Fixed in 5.13.3 CWE-1395

Vulnerabilities

Filters