Login Request a demo
WE
Vendor
WeblateOrg
2 products with CVEs on record
45
CVEs
0
On KEV
1
New 30D
Products
WE
weblate
WeblateOrg
9.8
40 CVEs0 on KEV1 new
WL
wlc
WeblateOrg
8.0
5 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-86035
WE
weblate
WeblateOrg
8.5
0%
Sep 29Weblate: Mercurial argument injection via repository filenames allows authenticated command execution
CVE-2026-62364
WL
wlc
WeblateOrg
2.3
0%
Sep 22wlc may disclose API tokens to project-configured URLs
CVE-2026-77573
WE
weblate
WeblateOrg
3.5
0%
Aug 26Weblate: DNS rebinding in VCS operations allows server-side request forgery
CVE-2026-77507
WE
weblate
WeblateOrg
5.3
0%
Aug 26Weblate: Object-scoped RSS feeds disclose private change history to unauthorized users
CVE-2026-62326
WE
weblate
WeblateOrg
6.5
1%
Aug 26Weblate Has Uncontrolled Resource Consumption via
CVE-2026-62249
WE
weblate
WeblateOrg
4.3
0%
Aug 26Weblate: Restricted-component change history leaked to non-member project users through the nested `GET /api/projects/{slug}/changes/` endpoint
CVE-2026-61792
WE
weblate
WeblateOrg
7.7
1%
Aug 26Weblate path traversal allows a project administrator to read arbitrary files via App store metadata download (Incomplete Fix of CVE-2026-34242)
CVE-2026-61790
WE
weblate
WeblateOrg
4.4
0%
Aug 26Weblate: Team-enforced 2FA is bypassed for global permissions
CVE-2026-55228
WE
weblate
WeblateOrg
8.1
0%
Aug 26Weblate:: WebIDOR in GroupViewSet allows authenticated project manager to gain unauthorized read access to any private project
CVE-2026-55227
WE
weblate
WeblateOrg
4.3
0%
Aug 26Observable object existence disclosure in private Weblate projects via globally scoped object lookups
CVE-2026-77508
WE
weblate
WeblateOrg
3.5
0%
Aug 26Weblate: Unverified REST API email changes
CVE-2026-45106
WE
weblate
WeblateOrg
4.6
0%
Jun 10Weblate: Stored HTML injection in editor search preview
CVE-2026-50127
WE
weblate
WeblateOrg
5.9
0%
Jun 10Weblate SSRF: outbound URL guard misses the NAT64 well-known prefix (64:ff9b::/96)
CVE-2026-42150
WL
wlc
WeblateOrg
4.8
0%
May 8wlc: print_html outputs API data without HTML escaping, enabling stored XSS
CVE-2026-44264
WE
weblate
WeblateOrg
4.3
0%
May 7Weblate is vulnerable to XSS via crafted Markdown
CVE-2026-44263
WE
weblate
WeblateOrg
4.3
0%
May 7Weblate: Private Translation Enumeration via Screenshot API
CVE-2026-41519
WE
weblate
WeblateOrg
5.4
0%
May 7Weblate's API Token Not Invalidated on Password Change
CVE-2026-41654
WE
weblate
WeblateOrg
8.1
0%
May 7Weblate is Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url
CVE-2026-40256
WE
weblate
WeblateOrg
5.0
0%
Apr 15Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision
CVE-2026-39845
WE
weblate
WeblateOrg
4.1
0%
Apr 15Weblate: SSRF via the webhook add-on using unprotected fetch_url()
CVE-2026-34393
WE
weblate
WeblateOrg
8.8
0%
Apr 15Weblate: Privilege escalation in the user API endpoint
CVE-2026-34244
WE
weblate
WeblateOrg
5.0
0%
Apr 15Weblate: SSRF via Project-Level Machinery Configuration
CVE-2026-34242
WE
weblate
WeblateOrg
7.7
0%
Apr 15Weblate: Arbitrary File Read via Symlink
CVE-2026-33440
WE
weblate
WeblateOrg
5.0
0%
Apr 15Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads
CVE-2026-33435
WE
weblate
WeblateOrg
8.0
1%
Apr 15Weblate: Remote code execution during backup restoration
CVE-2026-33220
WE
weblate
WeblateOrg
6.8
0%
Apr 15Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository
CVE-2026-33214
WE
weblate
WeblateOrg
4.3
0%
Apr 15Weblate has improper access control for the translation memory API
CVE-2026-33212
WE
weblate
WeblateOrg
3.1
0%
Apr 15Weblate: Improper access control for pending tasks in API
CVE-2026-27457
WE
weblate
WeblateOrg
4.3
0%
Feb 26Weblate: Missing access control for the AddonViewSet API exposes all addon configurations
CVE-2026-24126
WE
weblate
WeblateOrg
9.1
1%
Feb 18Weblate has an argument injection in management console
CVE-2026-23535
WL
wlc
WeblateOrg
8.0
0%
Jan 16wlc Path traversal: Unsanitized API slugs in download command
CVE-2026-21889
WE
weblate
WeblateOrg
7.5
0%
Jan 14Weblate leaks information via screenshots
CVE-2026-22251
WL
wlc
WeblateOrg
5.5
0%
Jan 12wlc may leak API keys due to an insecure API key configuration
CVE-2026-22250
WL
wlc
WeblateOrg
5.5
0%
Jan 12wlc can skip SSL verification
CVE-2025-68398
WE
weblate
WeblateOrg
9.1
1%
Dec 18Weblate has git config file overwrite vulnerability that leads to remote code execution
CVE-2025-68279
WE
weblate
WeblateOrg
6.5
0%
Dec 18Weblate has an arbitrary file read via symbolic links
CVE-2025-67715
WE
weblate
WeblateOrg
4.3
0%
Dec 16Weblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR)
CVE-2025-67492
WE
weblate
WeblateOrg
5.3
0%
Dec 16Weblate's over‑permissive webhook endpoint enables mass repository updates and component enumeration
CVE-2025-66407
WE
weblate
WeblateOrg
5.0
0%
Dec 15Weblate has Server-Side Request Forgery vulnerability
CVE-2025-64725
WE
weblate
WeblateOrg
9.8
0%
Dec 15Weblate has improper validation upon invitation acceptance
CVE-2025-64326
WE
weblate
WeblateOrg
3.5
0%
Nov 6Weblate leaks the IP of project members inviting users to assume reviewer roles in Audit log
CVE-2025-61587
WE
weblate
WeblateOrg
6.1
0%
Oct 1Weblate integration with Anubis can lead to Open Redirect via redir parameter
CVE-2025-58352
WE
weblate
WeblateOrg
6.5
0%
Sep 4Weblate has long session expiry times during second factor verification
CVE-2025-49134
WE
weblate
WeblateOrg
5.3
0%
Jun 16Weblate exposes personal IP address via e-mail
CVE-2025-47951
WE
weblate
WeblateOrg
4.9
0%
Jun 16Weblate lacks rate limiting when verifying second factor