CVE-2026-50127 | Medium | 5.9 | 2026-06-10 | Weblate is a web based localization tool. From version 5.15 to before version 2026.6, Weblate's VCS_RESTRICT_PRIVATE did not properly account for some transiti… |
CVE-2026-45106 | Medium | 4.6 | 2026-06-10 | Weblate is a web based localization tool. Prior to version 2026.5, Weblate's live search preview renders unit source and context as HTML without escaping. Any… |
CVE-2026-42150 | Medium | 5.1 | 2026-05-08 | wlc is a Weblate command-line client using Weblate's REST API. Prior to version 2.0.0, the HTML output format in wlc embeds API response data into HTML without… |
CVE-2026-44264 | Medium | 4.3 | 2026-05-07 | Weblate is a web based localization tool. Prior to version 5.17.1, the Markdown renderer used in user comments and other user-provided content didn't properly… |
CVE-2026-44263 | Medium | 4.3 | 2026-05-07 | Weblate is a web based localization tool. Prior to version 5.17.1, the screenshots, tasks, and component link API allowed for the enumeration of translations i… |
CVE-2026-41654 | High | 8.1 | 2026-05-07 | Weblate is a web based localization tool. Prior to version 5.17.1, an authenticated user with project.add permission (default on hosted Weblate SaaS and for an… |
CVE-2026-41519 | Medium | 4.2 | 2026-05-07 | Weblate is a web based localization tool. Prior to version 5.17.1, when a user changes their password, browser sessions are correctly invalidated via "cycle_se… |
CVE-2026-40256 | Medium | 5.0 | 2026-04-15 | Weblate is a web based localization tool. In versions prior to 5.17, repository-boundary validation relies on string prefix checks on resolved absolute paths… |
CVE-2026-39845 | Medium | 4.1 | 2026-04-15 | Weblate is a web based localization tool. In versions prior to 5.17, the webhook add-on did not utilize existing SSRF protections. This issue has been fixed in… |
CVE-2026-34393 | High | 8.8 | 2026-04-15 | Weblate is a web based localization tool. In versions prior to 5.17, the user patching API endpoint didn't properly limit the scope of edits. This issue has be… |
CVE-2026-34244 | Medium | 5.0 | 2026-04-15 | Weblate is a web based localization tool. In versions prior to 5.17, a user with the project.edit permission (granted by the per-project "Administration" role)… |
CVE-2026-34242 | High | 7.7 | 2026-04-15 | Weblate is a web based localization tool. In versions prior to 5.17, the ZIP download feature didn't verify downloaded files, potentially following symlinks o… |
CVE-2026-33440 | Medium | 5.0 | 2026-04-15 | Weblate is a web based localization tool. In versions prior to 5.17, the ALLOWED_ASSET_DOMAINS setting applied only to the first issued requests and didn't res… |
CVE-2026-33435 | High | 8.0 | 2026-04-15 | Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filter Git and Mercurial configuration files which could lead to… |
CVE-2026-33220 | Medium | 6.8 | 2026-04-15 | Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpoints, which in turn didn't perform prop… |
CVE-2026-33214 | Medium | 4.3 | 2026-04-15 | Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpoints, which in turn didn't enforce prop… |
CVE-2026-33212 | Low | 3.1 | 2026-04-15 | Weblate is a web based localization tool. In versions prior to 5.17, the tasks API didn't verify user access for pending tasks. This could expose logs of in-pr… |
CVE-2026-27457 | Medium | 4.3 | 2026-02-26 | Weblate is a web based localization tool. Prior to version 5.16.1, the REST API's `AddonViewSet` (`weblate/api/views.py`, line 2831) uses `queryset = Addon.obj… |
CVE-2026-24126 | Medium | 6.6 | 2026-02-19 | Weblate is a web based localization tool. Prior to 5.16.0, the SSH management console did not validate the passed input while adding the SSH host key, which co… |
CVE-2026-23535 | High | 8.0 | 2026-01-16 | wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.2, the multi-translation download could write to an arbitrary location when instru… |
CVE-2026-21889 | High | 7.5 | 2026-01-14 | Weblate is a web based localization tool. Prior to 5.15.2, the screenshot images were served directly by the HTTP server without proper access control. This co… |
CVE-2026-22251 | Medium | 5.3 | 2026-01-12 | wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, wlc supported providing unscoped API keys in the setting. This practice was dis… |
CVE-2026-22250 | Low | 2.5 | 2026-01-12 | wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, the SSL verification would be skipped for some crafted URLs. This vulnerability… |
CVE-2025-68398 | Critical | 9.1 | 2025-12-18 | Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to overwrite Git configuration remotely and override some of its behavio… |
CVE-2025-68279 | High | 7.7 | 2025-12-18 | Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to read arbitrary files from the server file system using crafted symbol… |
CVE-2025-67715 | Medium | 4.3 | 2025-12-16 | Weblate is a web based localization tool. In versions prior to 5.15, it was possible to retrieve user notification settings or list all users via API. Version… |
CVE-2025-67492 | Medium | 5.3 | 2025-12-16 | Weblate is a web based localization tool. In versions prior to 5.15, it was possible to trigger repository updates for many repositories via a crafted webhook… |
CVE-2025-66407 | Medium | 5.0 | 2025-12-16 | Weblate is a web based localization tool. The Create Component functionality in Weblate allows authorized users to add new translation components by specifying… |
CVE-2025-64725 | Critical | 9.8 | 2025-12-15 | Weblate is a web based localization tool. In versions prior to 5.15, it was possible to accept an invitation opened by a different user. Version 5.15. contains… |
CVE-2025-64326 | Low | 2.6 | 2025-11-06 | Weblate is a web based localization tool. In versions 5.14 and below, Weblate leaks the IP address of the project member inviting the user to the project in t… |
CVE-2025-61587 | Medium | 6.1 | 2025-10-01 | Weblate is a web based localization tool. An open redirect exists in versions 5.13.2 and below via the redir parameter on .within.website when Weblate is confi… |
CVE-2025-58352 | Medium | 6.5 | 2025-09-05 | Weblate is a web based localization tool. Versions lower than 5.13.1 contain a vulnerability that causes long session expiry during the second factor verifica… |
CVE-2025-49134 | Medium | 5.3 | 2025-06-16 | Weblate is a web based localization tool. Prior to version 5.12, the audit log notifications included the full IP address of the acting user. This could be obt… |
CVE-2025-47951 | Medium | 4.9 | 2025-06-16 | Weblate is a web based localization tool. Prior to version 5.12, the verification of the second factor was not subject to rate limiting. The absence of rate li… |
CVE-2025-32021 | Low | 2.2 | 2025-04-15 | Weblate is a web based localization tool. Prior to version 5.11, when creating a new component from an existing component that has a source code repository URL… |
CVE-2024-39303 | Medium | 4.4 | 2024-07-01 | Weblate is a web based localization tool. Prior to version 5.6.2, Weblate didn't correctly validate filenames when restoring project backup. It may be possible… |
CVE-2022-24710 | Medium | 5.4 | 2022-02-25 | Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutralize user input used in user name and lan… |