Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository

Weblate Has Uncontrolled Resource Consumption via

Weblate has an arbitrary file read via symbolic links

Weblate has long session expiry times during second factor verification

Weblate integration with Anubis can lead to Open Redirect via redir parameter

Weblate SSRF: outbound URL guard misses the NAT64 well-known prefix (64:ff9b::/96)

Weblate's API Token Not Invalidated on Password Change

Weblate: Object-scoped RSS feeds disclose private change history to unauthorized users

Weblate's over‑permissive webhook endpoint enables mass repository updates and component enumeration

Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision

Weblate: SSRF via Project-Level Machinery Configuration

Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads

Weblate has Server-Side Request Forgery vulnerability

Weblate: Stored HTML injection in editor search preview

Weblate: Team-enforced 2FA is bypassed for global permissions

Weblate: Restricted-component change history leaked to non-member project users through the nested `GET /api/projects/{slug}/changes/` endpoint

Observable object existence disclosure in private Weblate projects via globally scoped object lookups

Weblate is vulnerable to XSS via crafted Markdown

Weblate: Private Translation Enumeration via Screenshot API

Weblate has improper access control for the translation memory API

Weblate: Missing access control for the AddonViewSet API exposes all addon configurations

Weblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR)

Weblate: SSRF via the webhook add-on using unprotected fetch_url()