Vulnerabilities

TI-2026-58863 CVE-2026-86035

Weblate: Mercurial argument injection via repository filenames allows authenticated command execution

LOW 39

Weblate is a web-based continuous localization platform used to manage software translations.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00464 Published 2026-09-29 Fixed in 2026.8 CWE-78

TI-2026-44512 CVE-2026-62364 · GHSA-3mqq-hv9c-85hc

wlc may disclose API tokens to project-configured URLs

LOW 11

wlc is a Weblate command-line client using Weblate's REST API.

CVSS 3.1LOW 2.3 Local High privileges User interaction EPSS 0.0008 Published 2026-09-22 Fixed in 2.0.1 CWE-200

TI-2026-54082 CVE-2026-77573

Weblate: DNS rebinding in VCS operations allows server-side request forgery

LOW 16

Weblate is a web-based continuous localization platform used to manage software translations.

CVSS 3.1LOW 3.5 Network Low privileges No interaction EPSS 0.00204 Published 2026-08-26 Fixed in 2026.8 CWE-367

TI-2026-54040 CVE-2026-77507

Weblate: Object-scoped RSS feeds disclose private change history to unauthorized users

LOW 30

Weblate is a web-based continuous localization platform used to manage software translations.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0043 Published 2026-08-26 Fixed in 2026.8 CWE-200

TI-2026-44498 CVE-2026-62326

Weblate Has Uncontrolled Resource Consumption via

LOW 29

Weblate is a web-based continuous localization platform used to manage software translations.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00502 Published 2026-08-26 Fixed in 2026.7 CWE-400

TI-2026-44469 CVE-2026-62249

Information disclosure in WeblateOrg weblate

LOW 20

Weblate is a web-based continuous localization platform used to manage software translations.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00323 Published 2026-08-26 Fixed in 2026.7 CWE-200

TI-2026-44230 CVE-2026-61792

Path traversal in WeblateOrg weblate

LOW 34

Weblate is a web-based continuous localization platform used to manage software translations.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00586 Published 2026-08-26 Fixed in 2026.7 CWE-22

TI-2026-44229 CVE-2026-61790

Weblate: Team-enforced 2FA is bypassed for global permissions

LOW 21

Weblate is a web-based continuous localization platform used to manage software translations.

CVSS 3.1MEDIUM 4.4 Network High privileges No interaction EPSS 0.00399 Published 2026-08-26 Fixed in 2026.7 CWE-284

TI-2026-39905 CVE-2026-55228 · GHSA-2q2q-jr9g-v9rf

Authorization bypass in WeblateOrg weblate

LOW 38

Weblate is a web-based continuous localization platform used to manage software translations.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00448 Published 2026-08-26 Fixed in 2026.7 CWE-639

TI-2026-39904 CVE-2026-55227 · GHSA-2p9g-x3cv-5hh4

Observable object existence disclosure in private Weblate projects via globally scoped object lookups

LOW 20

Weblate is a web-based localization tool.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00324 Published 2026-08-26 Fixed in 2026.7 CWE-203

TI-2026-54041 CVE-2026-77508

Weblate: Unverified REST API email changes

LOW 16

Weblate is a web based localization tool.

CVSS 3.1LOW 3.5 Network Low privileges User interaction EPSS 0.00259 Published 2026-08-26 Fixed in 2026.8 CWE-302

TI-2026-32944 CVE-2026-45106 · GHSA-6wxc-8mgq-w26m

Weblate: Stored HTML injection in editor search preview

LOW 21

Weblate is a web based localization tool.

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00208 Published 2026-06-10 Fixed in 2026.5 CWE-79

TI-2026-36898 CVE-2026-50127 · GHSA-vmfc-9982-2m45

Weblate SSRF: outbound URL guard misses the NAT64 well-known prefix (64:ff9b::/96)

LOW 26

Weblate is a web based localization tool.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00308 Published 2026-06-10 Fixed in 2026.6 CWE-918

TI-2026-30480 CVE-2026-42150 · GHSA-gx2m-mcc2-r4p3

wlc: print_html outputs API data without HTML escaping, enabling stored XSS

LOW 22

wlc is a Weblate command-line client using Weblate's REST API.

CVSS 3.1MEDIUM 5.1 Network High privileges User interaction EPSS 0.00174 Published 2026-05-08 Fixed in 2.0.0 CWE-79

TI-2026-32240 CVE-2026-44264 · GHSA-5cmv-3rc4-7279

Weblate is vulnerable to XSS via crafted Markdown

LOW 20

Weblate is a web based localization tool.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00275 Published 2026-05-07 Fixed in 5.17.1 CWE-80

TI-2026-32239 CVE-2026-44263 · GHSA-gcg5-86jr-f7jg

Weblate: Private Translation Enumeration via Screenshot API

LOW 20

Weblate is a web based localization tool.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00338 Published 2026-05-07 Fixed in 5.17.1 CWE-203

TI-2026-30102 CVE-2026-41519 · GHSA-6j8j-4qp3-36p2

Weblate's API Token Not Invalidated on Password Change

LOW 24

Weblate is a web based localization tool.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.0027 Published 2026-05-07 Fixed in 5.17.1 CWE-613

TI-2026-30172 CVE-2026-41654 · GHSA-cwcx-382v-8m9g

Weblate is Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url

LOW 30

Weblate is a web based localization tool.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00371 Published 2026-05-07 Fixed in 5.17.1 CWE-20

TI-2026-29050 CVE-2026-40256 · GHSA-ffgh-3jrf-8wvh

Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision

LOW 23

Weblate is a web based localization tool.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00324 Published 2026-04-15 Fixed in 5.17 CWE-22

TI-2026-28727 CVE-2026-39845 · GHSA-f8hv-g549-hwg2

Weblate: SSRF via the webhook add-on using unprotected fetch_url()

LOW 19

Weblate is a web based localization tool.

CVSS 3.1MEDIUM 4.1 Network High privileges No interaction EPSS 0.00275 Published 2026-04-15 Fixed in 5.17 CWE-918

TI-2026-26679 CVE-2026-34393 · GHSA-3382-gw9x-477v

Weblate: Privilege escalation in the user API endpoint

MEDIUM 40

Weblate is a web based localization tool.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00391 Published 2026-04-15 Fixed in 5.17 CWE-269

TI-2026-26539 CVE-2026-34244 · GHSA-xrwr-fcw6-fmq8

Weblate: SSRF via Project-Level Machinery Configuration

LOW 22

Weblate is a web based localization tool.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00254 Published 2026-04-15 Fixed in 517, 5.17 CWE-200

TI-2026-26537 CVE-2026-34242 · GHSA-hv99-mxm5-q397

Weblate: Arbitrary File Read via Symlink

LOW 34

Weblate is a web based localization tool.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00465 Published 2026-04-15 Fixed in 5.17 CWE-200

TI-2026-25837 CVE-2026-33440 · GHSA-5fhx-9jwj-867m

Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads

LOW 22

Weblate is a web based localization tool.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.0024 Published 2026-04-15 Fixed in 5.17 CWE-918

TI-2026-25832 CVE-2026-33435 · GHSA-558g-h753-6m33

Weblate: Remote code execution during backup restoration

LOW 38

Weblate is a web based localization tool.

CVSS 3.1HIGH 8.1 Network High privileges No interaction EPSS 0.00708 Published 2026-04-15 Fixed in 5.17 CWE-23

Vulnerabilities

Filters