| Weblate has IDOR in GroupViewSet that allows authenticated project manager to gain unauthorized read access to any private projectCVE-2026-55228 · GHSA-2Q2Q-JR9G-V9RFVersion ranges need review. |
weblate |
PyPI |
High
|
Fix reported |
|
| Private Weblate projects vulnerable to observable object existence disclosure via globally scoped object lookupsCVE-2026-55227 · GHSA-2P9G-X3CV-5HH4Version ranges need review. |
weblate |
PyPI |
Medium
|
Fix reported |
|
| Weblate has improper validation upon invitation acceptanceCVE-2025-64725 · GHSA-M6HQ-F4W9-QRJJVersion ranges need review. |
weblate |
PyPI |
Low
|
Fix reported |
|
| Weblate has a long session expiry when verifying second factorCVE-2025-58352 · GHSA-377J-WJ38-4728Version ranges need review. |
weblate |
PyPI |
Low
|
Fix reported |
|
| Weblate exposes personal IP address via e-mailCVE-2025-49134 · GHSA-4QQF-9M5C-W2C5Version ranges need review. |
weblate |
PyPI |
Low
|
Fix reported |
|
| Weblate lacks rate limiting when verifying second factorCVE-2025-47951 · GHSA-57JG-M997-CX3QVersion ranges need review. |
weblate |
PyPI |
Medium
|
Fix reported |
|
| Weblate vulnerable to improper sanitization of project backupsCVE-2024-39303 · GHSA-JFGP-674X-6Q4PVersion ranges need review. |
weblate |
PyPI |
Low
|
Fix reported |
|
| Weblate: Stored HTML injection in editor search previewCVE-2026-45106 · GHSA-6WXC-8MGQ-W26MVersion ranges need review. |
weblate |
PyPI |
Medium
|
Fix reported |
|
| Weblate SSRF: outbound URL guard misses some private rangesCVE-2026-50127 · GHSA-VMFC-9982-2M45Version ranges need review. |
weblate |
PyPI |
Medium
|
Fix reported |
|
| Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix CollisionCVE-2026-40256 · GHSA-FFGH-3JRF-8WVHVersion ranges need review. |
weblate |
PyPI |
Medium
|
Fix reported |
|
| Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploadsCVE-2026-33440 · GHSA-5FHX-9JWJ-867MVersion ranges need review. |
weblate |
PyPI |
Medium
|
Fix reported |
|
| Weblate: SSRF via Project-Level Machinery Configuration CVE-2026-34244 · GHSA-XRWR-FCW6-FMQ8Version ranges need review. |
weblate |
PyPI |
Medium
|
Fix reported |
|
| Weblate: Improper access control for pending tasks in APICVE-2026-33212 · GHSA-VJ45-X3PJ-F4W4Version ranges need review. |
weblate |
PyPI |
Low
|
Fix reported |
|
| Weblate: Arbitrary File Read via SymlinkCVE-2026-34242 · GHSA-HV99-MXM5-Q397Version ranges need review. |
weblate |
PyPI |
High
|
Fix reported |
|
| Weblate vulnerable to XSS via crafted MarkdownCVE-2026-44264 · GHSA-5CMV-3RC4-7279Version ranges need review. |
weblate |
PyPI |
Medium
|
Fix reported |
|
| Weblate has an argument injection in management consoleCVE-2026-24126 · GHSA-33FM-6GP7-4P47Version ranges need review. |
weblate |
PyPI |
Medium
|
Fix reported |
|
| Weblate Doesn't Invalidate API Token on Password ChangeCVE-2026-41519 · GHSA-6J8J-4QP3-36P2Version ranges need review. |
weblate |
PyPI |
Medium
|
Fix reported |
|
| Weblate Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_urlCVE-2026-41654 · GHSA-CWCX-382V-8M9GVersion ranges need review. |
weblate |
PyPI |
Medium
|
Fix reported |
|
| Weblate: Missing access control for the AddonViewSet API exposes all addon configurationsCVE-2026-27457 · GHSA-WPPC-7CQ7-CGFVVersion ranges need review. |
weblate |
PyPI |
Medium
|
Fix reported |
|
| Weblate Vulnerable to Private Translation Enumeration via Screenshot APICVE-2026-44263 · GHSA-GCG5-86JR-F7JGVersion ranges need review. |
weblate |
PyPI |
Medium
|
Fix reported |
|
