WE
Vendor
Weblate
37
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-42150 | WL Wlc Weblate | 4.8 | May 8 | wlc: print_html outputs API data without HTML escaping, enabling stored XSS |
| CVE-2026-44264 | WE Weblate Weblate | 4.3 | May 7 | Weblate is vulnerable to XSS via crafted Markdown |
| CVE-2026-44263 | WE Weblate Weblate | 4.3 | May 7 | Weblate: Private Translation Enumeration via Screenshot API |
| CVE-2026-41519 | WE Weblate Weblate | 5.4 | May 7 | Weblate's API Token Not Invalidated on Password Change |
| CVE-2026-41654 | WE Weblate Weblate | 8.1 | May 7 | Weblate is Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url |
| CVE-2026-40256 | WE Weblate Weblate | 5.0 | Apr 15 | Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision |
| CVE-2026-39845 | WE Weblate Weblate | 4.1 | Apr 15 | Weblate: SSRF via the webhook add-on using unprotected fetch_url() |
| CVE-2026-34393 | WE Weblate Weblate | 8.8 | Apr 15 | Weblate: Privilege escalation in the user API endpoint |
| CVE-2026-34244 | WE Weblate Weblate | 5.0 | Apr 15 | Weblate: SSRF via Project-Level Machinery Configuration |
| CVE-2026-34242 | WE Weblate Weblate | 7.7 | Apr 15 | Weblate: Arbitrary File Read via Symlink |
| CVE-2026-33440 | WE Weblate Weblate | 5.0 | Apr 15 | Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads |
| CVE-2026-33435 | WE Weblate Weblate | 8.0 | Apr 15 | Weblate: Remote code execution during backup restoration |
| CVE-2026-33220 | WE Weblate Weblate | 6.8 | Apr 15 | Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository |
| CVE-2026-33214 | WE Weblate Weblate | 4.3 | Apr 15 | Weblate has improper access control for the translation memory API |
| CVE-2026-33212 | WE Weblate Weblate | 3.1 | Apr 15 | Weblate: Improper access control for pending tasks in API |
| CVE-2026-27457 | WE Weblate Weblate | 4.3 | Feb 26 | Weblate: Missing access control for the AddonViewSet API exposes all addon configurations |
| CVE-2026-24126 | WE Weblate Weblate | 9.1 | Feb 18 | Weblate has an argument injection in management console |
| CVE-2026-23535 | WL Wlc Weblate | 8.0 | Jan 16 | wlc Path traversal: Unsanitized API slugs in download command |
| CVE-2026-21889 | WE Weblate Weblate | 7.5 | Jan 14 | Weblate leaks information via screenshots |
| CVE-2026-22251 | WL Wlc Weblate | 5.5 | Jan 12 | wlc may leak API keys due to an insecure API key configuration |
| CVE-2026-22250 | WL Wlc Weblate | 5.5 | Jan 12 | wlc can skip SSL verification |
| CVE-2025-68398 | WE Weblate Weblate | 9.1 | Dec 18 | Weblate has git config file overwrite vulnerability that leads to remote code execution |
| CVE-2025-68279 | WE Weblate Weblate | 6.5 | Dec 18 | Weblate has an arbitrary file read via symbolic links |
| CVE-2025-67715 | WE Weblate Weblate | 4.3 | Dec 16 | Weblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR) |
| CVE-2025-67492 | WE Weblate Weblate | 5.3 | Dec 16 | Weblate's over‑permissive webhook endpoint enables mass repository updates and component enumeration |
| CVE-2025-66407 | WE Weblate Weblate | 5.0 | Dec 15 | Weblate has Server-Side Request Forgery vulnerability |
| CVE-2025-64725 | WE Weblate Weblate | 9.8 | Dec 15 | Weblate has improper validation upon invitation acceptance |
| CVE-2025-64326 | WE Weblate Weblate | 3.5 | Nov 6 | Weblate leaks the IP of project members inviting users to assume reviewer roles in Audit log |
| CVE-2025-61587 | WE Weblate Weblate | 6.1 | Oct 1 | Weblate integration with Anubis can lead to Open Redirect via redir parameter |
| CVE-2025-58352 | WE Weblate Weblate | 6.5 | Sep 5 | Weblate is a web based localization tool |
| CVE-2025-49134 | WE Weblate Weblate | 5.3 | Jun 16 | Weblate is a web based localization tool |
| CVE-2025-47951 | WE Weblate Weblate | 4.9 | Jun 16 | Weblate is a web based localization tool |
| CVE-2025-32021 | WE Weblate Weblate | 7.5 | Apr 15 | Weblate is a web based localization tool |
| CVE-2024-39303 | WE Weblate Weblate | 5.4 | Jul 1 | Weblate is a web based localization tool |
| CVE-2022-23915 | WE Weblate Weblate | 8.8 | Mar 4 | The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories |
| CVE-2022-24710 | WE Weblate Weblate | 5.4 | Feb 25 | Weblate is a copyleft software web-based continuous localization system |
| CVE-2017-5537 | WE Weblate Weblate | 5.3 | Mar 15 | The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote… |