WeblateOrg vulnerabilities

CVEs per yearBy the year they were published

1. 20221
2. 20241
3. 202512
4. 202634

Newest CVEs

• CVE-2026-86035

  Weblate: Mercurial argument injection via repository filenames allows authenticated command execution

  WeblateOrg · weblate

  High8.5
• CVE-2026-62364

  wlc may disclose API tokens to project-configured URLs

  WeblateOrg · wlc

  Low2.3
• CVE-2026-77573

  Weblate: DNS rebinding in VCS operations allows server-side request forgery

  WeblateOrg · weblate

  Low3.5
• CVE-2026-77507

  Weblate: Object-scoped RSS feeds disclose private change history to unauthorized users

  WeblateOrg · weblate

  Medium5.3
• CVE-2026-62326

  Weblate Has Uncontrolled Resource Consumption via

  WeblateOrg · weblate

  Medium6.5
• CVE-2026-62249

  Weblate: Restricted-component change history leaked to non-member project users through the nested `GET /api/projects/{slug}/changes/` endpoint

  WeblateOrg · weblate

  Medium4.3
• CVE-2026-61792

  Weblate path traversal allows a project administrator to read arbitrary files via App store metadata download (Incomplete Fix of CVE-2026-34242)

  WeblateOrg · weblate

  High7.7
• CVE-2026-61790

  Weblate: Team-enforced 2FA is bypassed for global permissions

  WeblateOrg · weblate

  Medium4.4
• CVE-2026-55228

  Weblate:: WebIDOR in GroupViewSet allows authenticated project manager to gain unauthorized read access to any private project

  WeblateOrg · weblate

  High8.1
• CVE-2026-55227

  Observable object existence disclosure in private Weblate projects via globally scoped object lookups

  WeblateOrg · weblate

  Medium4.3