WE
Product
Weblate
33
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 7Medium 21Low 2
Watch
Add Weblate to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-33220 | 6.8 | Apr 15 | Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository Affected: before 5.17 |
| CVE-2025-68279 | 6.5 | Dec 18 | Weblate has an arbitrary file read via symbolic links Affected: before 5.15.1 |
| CVE-2025-58352 | 6.5 | Sep 5 | Weblate is a web based localization tool Affected: before 5.13.1 |
| CVE-2025-61587 | 6.1 | Oct 1 | Weblate integration with Anubis can lead to Open Redirect via redir parameter Affected: before 5.13.3 |
| CVE-2026-41519 | 5.4 | May 7 | Weblate's API Token Not Invalidated on Password Change Affected: before 5.17.1 |
| CVE-2024-39303 | 5.4 | Jul 1 | Weblate is a web based localization tool Affected: 4.14 before 5.6.2 |
| CVE-2022-24710 | 5.4 | Feb 25 | Weblate is a copyleft software web-based continuous localization system Affected: before 4.11 |
| CVE-2025-67492 | 5.3 | Dec 16 | Weblate's over‑permissive webhook endpoint enables mass repository updates and component enumeration Affected: before 5.15 |
| CVE-2025-49134 | 5.3 | Jun 16 | Weblate is a web based localization tool Affected: before 5.12 |
| CVE-2017-5537 | 5.3 | Mar 15 | The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote… Affected: through 2.10 |
| CVE-2026-40256 | 5.0 | Apr 15 | Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision Affected: before 5.17 |
| CVE-2026-34244 | 5.0 | Apr 15 | Weblate: SSRF via Project-Level Machinery Configuration Affected: before 5.17 |
| CVE-2026-33440 | 5.0 | Apr 15 | Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads Affected: before 5.17 |
| CVE-2025-66407 | 5.0 | Dec 15 | Weblate has Server-Side Request Forgery vulnerability Affected: before 5.15 |
| CVE-2025-47951 | 4.9 | Jun 16 | Weblate is a web based localization tool Affected: before 5.12 |
| CVE-2026-44264 | 4.3 | May 7 | Weblate is vulnerable to XSS via crafted Markdown Affected: before 5.17.1 |
| CVE-2026-44263 | 4.3 | May 7 | Weblate: Private Translation Enumeration via Screenshot API Affected: before 5.17.1 |
| CVE-2026-33214 | 4.3 | Apr 15 | Weblate has improper access control for the translation memory API Affected: before 5.17 |
| CVE-2026-27457 | 4.3 | Feb 26 | Weblate: Missing access control for the AddonViewSet API exposes all addon configurations Affected: before 5.16.1 |
| CVE-2025-67715 | 4.3 | Dec 16 | Weblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR) Affected: before 5.15 |
| CVE-2026-39845 | 4.1 | Apr 15 | Weblate: SSRF via the webhook add-on using unprotected fetch_url() Affected: before 5.17 |
Showing 21