Advisories · Technology
weblate.
Every CVE that names weblate among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.5 High
Weblate: Mercurial argument injection via repository filenames allows authenticated command execution
- weblate
- Command injection
- CVSS 3.5 Low
Weblate: DNS rebinding in VCS operations allows server-side request forgery
- weblate
- Race condition
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Weblate: Object-scoped RSS feeds disclose private change history to unauthorized users
- weblate
- Information disclosure
- Broken access control
- CVSS 6.5 Medium
Weblate Has Uncontrolled Resource Consumption via
- weblate
- Denial of service
- CVSS 4.3 Medium
Weblate: Restricted-component change history leaked to non-member project users through the nested `GET /api/projects/{slug}/changes/` endpoint
- weblate
- Information disclosure
- Broken access control
- CVSS 7.7 High
Weblate path traversal allows a project administrator to read arbitrary files via App store metadata download (Incomplete Fix of CVE-2026-34242)
- weblate
- Path traversal
- CWE-693
- CVSS 4.4 Medium
Weblate: Team-enforced 2FA is bypassed for global permissions
- weblate
- Broken access control
- CVSS 3.5 Low
Weblate: Unverified REST API email changes
- weblate
- CWE-302
- CWE-841