Weblate has improper validation upon invitation acceptance

Weblate has an argument injection in management console

Weblate has git config file overwrite vulnerability that leads to remote code execution

Weblate: Privilege escalation in the user API endpoint

Weblate: Mercurial argument injection via repository filenames allows authenticated command execution

Weblate:: WebIDOR in GroupViewSet allows authenticated project manager to gain unauthorized read access to any private project

Weblate is Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url

Weblate: Remote code execution during backup restoration

Weblate path traversal allows a project administrator to read arbitrary files via App store metadata download (Incomplete Fix of CVE-2026-34242)

Weblate: Arbitrary File Read via Symlink

Weblate leaks information via screenshots

Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository

Weblate Has Uncontrolled Resource Consumption via

Weblate has an arbitrary file read via symbolic links

Weblate integration with Anubis can lead to Open Redirect via redir parameter

Weblate SSRF: outbound URL guard misses the NAT64 well-known prefix (64:ff9b::/96)

Weblate's API Token Not Invalidated on Password Change

Weblate: Object-scoped RSS feeds disclose private change history to unauthorized users

Weblate's over‑permissive webhook endpoint enables mass repository updates and component enumeration

Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision

Weblate: SSRF via Project-Level Machinery Configuration

Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads

Weblate has Server-Side Request Forgery vulnerability

Weblate: Stored HTML injection in editor search preview

Weblate: Team-enforced 2FA is bypassed for global permissions

Weblate: Restricted-component change history leaked to non-member project users through the nested `GET /api/projects/{slug}/changes/` endpoint

Observable object existence disclosure in private Weblate projects via globally scoped object lookups

Weblate is vulnerable to XSS via crafted Markdown

Weblate: Private Translation Enumeration via Screenshot API

Weblate has improper access control for the translation memory API

Weblate: Missing access control for the AddonViewSet API exposes all addon configurations

Weblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR)

Weblate: SSRF via the webhook add-on using unprotected fetch_url()

Weblate: DNS rebinding in VCS operations allows server-side request forgery

Weblate: Unverified REST API email changes

Weblate leaks the IP of project members inviting users to assume reviewer roles in Audit log

Weblate: Improper access control for pending tasks in API