WE
Product
weblate
37
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 3High 8Medium 23Low 4
Watch
Add weblate to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-34393 | 8.8 | Apr 15 | Weblate: Privilege escalation in the user API endpoint Affected: < 5.17 |
| CVE-2026-86035 | 8.5 | Sep 29 | Weblate: Mercurial argument injection via repository filenames allows authenticated command execution Affected: >= 4.11.1, < 2026.8 |
| CVE-2026-55228 | 8.1 | Aug 26 | Weblate:: WebIDOR in GroupViewSet allows authenticated project manager to gain unauthorized read access to any private project Affected: < 2026.7 |
| CVE-2026-41654 | 8.1 | May 7 | Weblate is Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url Affected: < 5.17.1 |
| CVE-2026-33435 | 8.0 | Apr 15 | Weblate: Remote code execution during backup restoration Affected: < 5.17 |
| CVE-2026-61792 | 7.7 | Aug 26 | Weblate path traversal allows a project administrator to read arbitrary files via App store metadata download (Incomplete Fix of CVE-2026-34242) Affected: < 2026.7 |
| CVE-2026-34242 | 7.7 | Apr 15 | Weblate: Arbitrary File Read via Symlink Affected: < 5.17 |
| CVE-2026-21889 | 7.5 | Jan 14 | Weblate leaks information via screenshots Affected: < 5.15.2 |
Showing 8