WE
Product
Weblate
33
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 7Medium 21Low 2
Watch
Add Weblate to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-64725 | 9.8 | Dec 15 | Weblate has improper validation upon invitation acceptance Affected: before 5.15 |
| CVE-2026-24126 | 9.1 | Feb 18 | Weblate has an argument injection in management console Affected: before 5.16 |
| CVE-2025-68398 | 9.1 | Dec 18 | Weblate has git config file overwrite vulnerability that leads to remote code execution Affected: before 5.15.1 |
| CVE-2026-34393 | 8.8 | Apr 15 | Weblate: Privilege escalation in the user API endpoint Affected: before 5.17 |
| CVE-2022-23915 | 8.8 | Mar 4 | The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories Affected: before 4.11.1 |
| CVE-2026-41654 | 8.1 | May 7 | Weblate is Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url Affected: before 5.17.1 |
| CVE-2026-33435 | 8.0 | Apr 15 | Weblate: Remote code execution during backup restoration Affected: before 5.17 |
| CVE-2026-34242 | 7.7 | Apr 15 | Weblate: Arbitrary File Read via Symlink Affected: before 5.17 |
| CVE-2026-21889 | 7.5 | Jan 14 | Weblate leaks information via screenshots Affected: before 5.15.2 |
| CVE-2025-32021 | 7.5 | Apr 15 | Weblate is a web based localization tool Affected: before 5.11 |
| CVE-2026-33220 | 6.8 | Apr 15 | Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository Affected: before 5.17 |
| CVE-2025-68279 | 6.5 | Dec 18 | Weblate has an arbitrary file read via symbolic links Affected: before 5.15.1 |
| CVE-2025-58352 | 6.5 | Sep 5 | Weblate is a web based localization tool Affected: before 5.13.1 |
| CVE-2025-61587 | 6.1 | Oct 1 | Weblate is a web based localization tool Affected: before 5.13.3 |
| CVE-2026-41519 | 5.4 | May 7 | Weblate's API Token Not Invalidated on Password Change Affected: before 5.17.1 |
| CVE-2024-39303 | 5.4 | Jul 1 | Weblate is a web based localization tool Affected: 4.14 before 5.6.2 |
| CVE-2022-24710 | 5.4 | Feb 25 | Weblate is a copyleft software web-based continuous localization system Affected: before 4.11 |
| CVE-2025-67492 | 5.3 | Dec 16 | Weblate's over‑permissive webhook endpoint enables mass repository updates and component enumeration Affected: before 5.15 |
| CVE-2025-49134 | 5.3 | Jun 16 | Weblate is a web based localization tool Affected: before 5.12 |
| CVE-2017-5537 | 5.3 | Mar 15 | The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote… Affected: through 2.10 |
| CVE-2026-40256 | 5.0 | Apr 15 | Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision Affected: before 5.17 |
| CVE-2026-34244 | 5.0 | Apr 15 | Weblate: SSRF via Project-Level Machinery Configuration Affected: before 5.17 |
| CVE-2026-33440 | 5.0 | Apr 15 | Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads Affected: before 5.17 |
| CVE-2025-66407 | 5.0 | Dec 15 | Weblate has Server-Side Request Forgery vulnerability Affected: before 5.15 |
| CVE-2025-47951 | 4.9 | Jun 16 | Weblate is a web based localization tool Affected: before 5.12 |
| CVE-2026-44264 | 4.3 | May 7 | Weblate is vulnerable to XSS via crafted Markdown Affected: before 5.17.1 |
| CVE-2026-44263 | 4.3 | May 7 | Weblate: Private Translation Enumeration via Screenshot API Affected: before 5.17.1 |
| CVE-2026-33214 | 4.3 | Apr 15 | Weblate has improper access control for the translation memory API Affected: before 5.17 |
| CVE-2026-27457 | 4.3 | Feb 26 | Weblate: Missing access control for the AddonViewSet API exposes all addon configurations Affected: before 5.16.1 |
| CVE-2025-67715 | 4.3 | Dec 16 | Weblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR) Affected: before 5.15 |
| CVE-2026-39845 | 4.1 | Apr 15 | Weblate: SSRF via the webhook add-on using unprotected fetch_url() Affected: before 5.17 |
| CVE-2025-64326 | 3.5 | Nov 6 | Weblate leaks the IP of project members inviting users to assume reviewer roles in Audit log Affected: before 5.14.1 |
| CVE-2026-33212 | 3.1 | Apr 15 | Weblate: Improper access control for pending tasks in API Affected: before 5.17 |
Showing 33