Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
50 results
Sep 29, 2026Weblate is a web-based continuous localization platform used to manage software translations.CVE-2026-86035 · Other software · WeblateOrg · reported by GitHubHigh 8.5
Weblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 2026.7.1 contains an argument-injection vulnerability in its Mercurial backend. Repository filenames beginning with - could be interpreted as Mercurial options instead of literal paths. An authenticated user with project-scoped component.edit permission could exploit this through a Mercurial-backed RESX component using the Update RESX files add-on. A later repository update could execute arbitrary commands with the privileges of the Weblate service account. This is a residual incomplete fix for CVE-2022-23915. This issue has been patched in version 2026.8.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026wlc is a Weblate command-line client using Weblate's REST API.CVE-2026-62364 · Other software · WeblateOrg · reported by GitHubLow 2.3
wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through WLC_KEY or --key without a matching WLC_URL or --url. When wlc runs in an untrusted repository, pull request checkout, or directory with untrusted ancestor configuration, it can send the token to an attacker-controlled project-configured URL. URL-scoped keys in [keys] are not affected. This issue is fixed in version 2.0.1.
- Product
- wlc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026Weblate is a web-based continuous localization platform used to manage software translations.CVE-2026-77573 · Other software · WeblateOrg · reported by GitHubLow 3.5
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, a user permitted to manage component repository URLs can perform server-side request forgery against internal services through DNS rebinding during VCS operations. Weblate validates the hostname's first DNS resolution, but the external VCS clients that later connect perform a separate DNS lookup, so an attacker-controlled hostname that initially resolves to a public address can be re-pointed to an internal or private address before the connection is made. By triggering a clone, fetch, push, or similar remote operation, the attacker can cause Weblate to reach internal VCS-compatible services and potentially expose private repository contents. Installations that permit untrusted repository hostnames while using VCS_RESTRICT_PRIVATE=True are affected. This issue is fixed in version 2026.8.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026Weblate is a web-based continuous localization platform used to manage software translations.CVE-2026-77507 · Other software · WeblateOrg · reported by GitHubMedium 5.3
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, Weblate's object-scoped RSS feeds do not apply the permission checks used elsewhere, allowing unauthorized users to read change-history metadata from private projects and restricted components. On installations that permit anonymous access, this metadata can be retrieved without any authentication. The exposed information can include project and component identities, contributor usernames and full names, action types, timestamps, and translation or unit links, though translated-string content is not included in the feed. Installations using private projects or restricted components are affected. This issue is fixed in version 2026.8.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026Weblate is a web-based continuous localization platform used to manage software translations.CVE-2026-62326 · Other software · WeblateOrg · reported by GitHubMedium 6.5
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a user with the built-in "Edit source" role can store a malicious regular expression in a source string's flags that is executed without any timeout, allowing them to stall requests and deny service. Regular expressions supplied through the regex: quality check and regex placeholders are compiled during validation but later run against translation content in RegexCheck and PlaceholderCheck with no time limit, so a catastrophic-backtracking pattern like ^(a|aa)+$ can consume CPU indefinitely. Because Weblate re-runs these checks for every linked target unit in the same request when a source unit's flags change, a single edit can trigger sustained CPU-bound denial of service. This issue is fixed in version 2026.7.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026Weblate is a web-based continuous localization platform used to manage software translations.CVE-2026-62249 · Other software · WeblateOrg · reported by GitHubMedium 4.3
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, an authenticated user with access to a project can retrieve the change history of restricted components in that project through nested API change endpoints, even without permission to view those components directly. The nested endpoints do not apply the component-level access checks enforced on the direct component views, so the requester can enumerate changes for components that should be hidden from them. The exposed data can include the restricted component's identity, translation and unit links, and change payload fields such as source or translated string content in the target, old, and details values. This issue is fixed in version 2026.7.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026Weblate is a web-based continuous localization platform used to manage software translations.CVE-2026-61792 · Other software · WeblateOrg · reported by GitHubHigh 7.7
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a project administrator can read files outside their repository through the App store metadata download feature, which resolves attacker-influenced paths without adequately confining them to the repository. This is an incomplete fix for CVE-2026-34242, whose original patch failed to fully prevent the path traversal, allowing the arbitrary file read to persist. A user with project-administrator privileges can therefore disclose the contents of files on the Weblate host that lie outside the project's repository. This issue is fixed in version 2026.7.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026Weblate is a web-based continuous localization platform used to manage software translations.CVE-2026-61790 · Other software · WeblateOrg · reported by GitHubMedium 4.4
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a team can require its members to configure two-factor authentication before receiving the team's permissions, but this requirement is not enforced for site-wide global permissions. As a result, a user who belongs to a team that enforces 2FA and grants a global permission still receives that global permission even without 2FA configured, while the same requirement is correctly applied to project-, component-, and workspace-scoped permissions. Such a user can act on the granted global permission, including reaching the site management interface at /manage/. This issue is fixed in version 2026.7.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026Weblate is a web-based continuous localization platform used to manage software translations.CVE-2026-55228 · Other software · WeblateOrg · reported by GitHubHigh 8.1
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, the REST API did not properly enforce the scope of project- and workspace-scoped teams, allowing a user to submit invalid team configurations through the API. By assigning projects to a team via these unvalidated requests, a user could grant access to projects they were not authorized to see or manage. This could expose private projects and permit translation, repository, and project-management operations outside the user's intended permission scope. This issue is fixed in version 2026.7.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026Weblate is a web-based localization tool.CVE-2026-55227 · Other software · WeblateOrg · reported by GitHubMedium 4.3
Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally scoped manner rather than restricting the lookup to projects the user can access, so they return HTTP 403 (Forbidden) instead of 404 (Not Found) when a user requests an object they are not authorized to see. This difference lets unauthorized users infer whether a given object exists in a private Weblate project. The issue has been fixed in version 2026.7.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026Weblate is a web based localization tool.CVE-2026-77508 · Other software · WeblateOrg · reported by GitHubLow 3.5
Weblate is a web based localization tool. Prior to 2026.8, an authenticated user can change the account's primary email through PUT or PATCH requests to /api/users/{username}/ without verifying the new address, allowing a later team invitation for that address to be accepted without access to the intended recipient's mailbox. This issue is fixed in version 2026.8.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2026Weblate is a web based localization tool.CVE-2026-50127 · Other software · WeblateOrg · reported by GitHubMedium 5.9
Weblate is a web based localization tool. From version 5.15 to before version 2026.6, Weblate's VCS_RESTRICT_PRIVATE did not properly account for some transitional IPv6 ranges, multicast addresses, or some semi-private IPv4 ranges, which allowed some addresses to bypass private range restrictions. This issue has been patched in version 2026.6.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2026Weblate is a web based localization tool.CVE-2026-45106 · Other software · WeblateOrg · reported by GitHubMedium 4.6
Weblate is a web based localization tool. Prior to version 2026.5, Weblate's live search preview renders unit source and context as HTML without escaping. Any contributor whose content reaches those fields stores HTML and CSS that runs inside the authenticated editor of every user who runs a matching search. This issue has been patched in version 2026.5.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026wlc is a Weblate command-line client using Weblate's REST API.CVE-2026-42150 · Other software · WeblateOrg · reported by GitHubMedium 5.1
wlc is a Weblate command-line client using Weblate's REST API. Prior to version 2.0.0, the HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser. This issue has been patched in version 2.0.0.
- Product
- wlc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026Weblate is a web based localization tool.CVE-2026-44264 · Other software · WeblateOrg · reported by GitHubMedium 4.3
Weblate is a web based localization tool. Prior to version 5.17.1, the Markdown renderer used in user comments and other user-provided content didn't properly sanitize some attributes. This issue has been patched in version 5.17.1.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026Weblate is a web based localization tool.CVE-2026-44263 · Other software · WeblateOrg · reported by GitHubMedium 4.3
Weblate is a web based localization tool. Prior to version 5.17.1, the screenshots, tasks, and component link API allowed for the enumeration of translations in a project inaccessible to the user. This issue has been patched in version 5.17.1.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026Weblate is a web based localization tool.CVE-2026-41654 · Other software · WeblateOrg · reported by GitHubMedium 5.3
Weblate is a web based localization tool. Prior to version 5.17.1, an authenticated user with project.add permission (default on hosted Weblate SaaS and for any user holding an active billing/trial plan) can import a crafted project backup ZIP whose components/<name>.json contains an attacker-chosen repo URL pointing at a private address (e.g. http://127.0.0.1:9999/) or using a non-allow-listed scheme (e.g. file://, git://). Weblate persists the component via Component.objects.bulk_create([component])[0], which bypasses Django's full_clean() and therefore never runs the validate_repo_url validator. The URL is subsequently written verbatim into .git/config by configure_repo(pull=False). This issue has been patched in version 5.17.1.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026Weblate is a web based localization tool.CVE-2026-41519 · Other software · WeblateOrg · reported by GitHubMedium 4.2
Weblate is a web based localization tool. Prior to version 5.17.1, when a user changes their password, browser sessions are correctly invalidated via "cycle_session_keys()", but DRF API tokens ("wlu_*" prefix) stored in "authtoken_token" are not revoked. This issue has been patched in version 5.17.1.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2026Weblate is a web based localization tool.CVE-2026-40256 · Other software · WeblateOrg · reported by GitHubMedium 5
Weblate is a web based localization tool. In versions prior to 5.17, repository-boundary validation relies on string prefix checks on resolved absolute paths. In multiple code paths, the check uses startswith against the repository root path. This is not path-segment aware and can be bypassed when the external path shares the same string prefix as the repository path (for example, repo and repo_outside). This issue has been fixed in version 5.17.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2026Weblate is a web based localization tool.CVE-2026-39845 · Other software · WeblateOrg · reported by GitHubMedium 4.1
Weblate is a web based localization tool. In versions prior to 5.17, the webhook add-on did not utilize existing SSRF protections. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can disable the webhook add-on as a workaround.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2026Weblate is a web based localization tool.CVE-2026-34393 · Other software · WeblateOrg · reported by GitHubHigh 8.8
Weblate is a web based localization tool. In versions prior to 5.17, the user patching API endpoint didn't properly limit the scope of edits. This issue has been fixed in version 5.17.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2026Weblate is a web based localization tool.CVE-2026-34244 · Other software · WeblateOrg · reported by GitHubMedium 5
Weblate is a web based localization tool. In versions prior to 5.17, a user with the project.edit permission (granted by the per-project "Administration" role) can configure machine translation service URLs pointing to arbitrary internal network addresses. During configuration validation, Weblate makes an HTTP request to the attacker-controlled URL and reflects up to 200 characters of the response body back to the user in an error message. This constitutes a Server-Side Request Forgery (SSRF) with partial response read. This issue has been fixed in version 5.17. If developers are unable to immediately upgrade, they can limit available machinery services via WEBLATE_MACHINERY setting.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2026Weblate is a web based localization tool.CVE-2026-34242 · Other software · WeblateOrg · reported by GitHubHigh 7.7
Weblate is a web based localization tool. In versions prior to 5.17, the ZIP download feature didn't verify downloaded files, potentially following symlinks outside the repository. This issue has been fixed in version 5.17.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2026Weblate is a web based localization tool.CVE-2026-33440 · Other software · WeblateOrg · reported by GitHubMedium 5
Weblate is a web based localization tool. In versions prior to 5.17, the ALLOWED_ASSET_DOMAINS setting applied only to the first issued requests and didn't restrict possible redirects. This issue has been fixed in version 5.17.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2026Weblate is a web based localization tool.CVE-2026-33435 · Other software · WeblateOrg · reported by GitHubHigh 8
Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filter Git and Mercurial configuration files which could lead to remote code execution under certain circumstances. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can limit the scope of the vulnerability by restricting access to the project backup, as it is only accessible to users who can create projects.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2026Weblate is a web based localization tool.CVE-2026-33220 · Other software · WeblateOrg · reported by GitHubMedium 6.8
Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpoints, which in turn didn't perform proper access control. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can disable this feature as the CDN add-on is not enabled by default.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2026Weblate is a web based localization tool.CVE-2026-33214 · Other software · WeblateOrg · reported by GitHubMedium 4.3
Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpoints, which in turn didn't enforce proper access control. This issue has been fixed in version 5.17. If users are unable to update immediately, they can work around this issue by blocking access to /api/memory/ in the HTTP server, which removes access to this feature.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2026Weblate is a web based localization tool.CVE-2026-33212 · Other software · WeblateOrg · reported by GitHubLow 3.1
Weblate is a web based localization tool. In versions prior to 5.17, the tasks API didn't verify user access for pending tasks. This could expose logs of in-progress operations to users who don't have access to given scope. The attacker needs to brute-force the random UUID of the task, so exploiting this is unlikely with the default API rate limits. This issue has been fixed in version 5.17.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026Weblate is a web based localization tool.CVE-2026-27457 · Other software · WeblateOrg · reported by GitHubMedium 4.3
Weblate is a web based localization tool. Prior to version 5.16.1, the REST API's `AddonViewSet` (`weblate/api/views.py`, line 2831) uses `queryset = Addon.objects.all()` without overriding `get_queryset()` to scope results by user permissions. This allows any authenticated user (or anonymous users if `REQUIRE_LOGIN` is not set) to list and retrieve ALL addons across all projects and components via `GET /api/addons/` and `GET /api/addons/{id}/`. Version 5.16.1 fixes the issue.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026Weblate is a web based localization tool.CVE-2026-24126 · Other software · WeblateOrg · reported by GitHubMedium 6.6
Weblate is a web based localization tool. Prior to 5.16.0, the SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument injection to `ssh-add`. Version 5.16.0 fixes the issue. As a workaround, properly limit access to the management console.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2026wlc is a Weblate command-line client using Weblate's REST API.CVE-2026-23535 · Other software · WeblateOrg · reported by GitHubHigh 8
wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.2, the multi-translation download could write to an arbitrary location when instructed by a crafted server. This vulnerability is fixed in 1.17.2.
- Product
- wlc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2026Weblate is a web based localization tool.CVE-2026-21889 · Other software · WeblateOrg · reported by GitHubLow 2.3
Weblate is a web based localization tool. Prior to 5.15.2, the screenshot images were served directly by the HTTP server without proper access control. This could allow an unauthenticated user to access screenshots after guessing their filename. This vulnerability is fixed in 5.15.2.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026wlc is a Weblate command-line client using Weblate's REST API.CVE-2026-22251 · Other software · WeblateOrg · reported by GitHubMedium 5.3
wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, wlc supported providing unscoped API keys in the setting. This practice was discouraged for years, but the code was never removed. This might cause the API key to be leaked to different servers.
- Product
- wlc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026wlc is a Weblate command-line client using Weblate's REST API.CVE-2026-22250 · Other software · WeblateOrg · reported by GitHubLow 2.5
wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, the SSL verification would be skipped for some crafted URLs. This vulnerability is fixed in 1.17.0.
- Product
- wlc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2025Weblate is a web based localization tool.CVE-2025-68398 · Other software · WeblateOrg · reported by GitHubCritical 9.1
Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to overwrite Git configuration remotely and override some of its behavior. Version 5.15.1 fixes the issue.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2025Weblate is a web based localization tool.CVE-2025-68279 · Other software · WeblateOrg · reported by GitHubHigh 7.7
Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to read arbitrary files from the server file system using crafted symbolic links in the repository. Version 5.15.1 fixes the issue.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2025Weblate is a web based localization tool.CVE-2025-67715 · Other software · WeblateOrg · reported by GitHubMedium 4.3
Weblate is a web based localization tool. In versions prior to 5.15, it was possible to retrieve user notification settings or list all users via API. Version 5.15 fixes the issue.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2025Weblate is a web based localization tool.CVE-2025-67492 · Other software · WeblateOrg · reported by GitHubMedium 5.3
Weblate is a web based localization tool. In versions prior to 5.15, it was possible to trigger repository updates for many repositories via a crafted webhook payload. Version 5.15 fixes the issue. As a workaround, disabling webhooks completely using ENABLE_HOOKS avoids this vulnerability.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2025Weblate is a web based localization tool.CVE-2025-66407 · Other software · WeblateOrg · reported by GitHubMedium 5
Weblate is a web based localization tool. The Create Component functionality in Weblate allows authorized users to add new translation components by specifying both a version control system and a source code repository URL to pull from. However, prior to version 5.15, the repository URL field is not validated or sanitized, allowing an attacker to supply arbitrary protocols, hostnames, and IP addresses, including localhost, internal network addresses, and local filenames. When the Mercurial version control system is selected, Weblate exposes the full server-side HTTP response for the provided URL. This effectively creates a server-side request forgery (SSRF) primitive that can probe internal services and return their contents. In addition to accessing internal HTTP endpoints, the behavior also enables local file enumeration by attempting file:// requests. While file contents may not always be returned, the application’s error messages clearly differentiate between files that exist and files that do not, revealing information about the server’s filesystem layout. In cloud environments, this behavior is particularly dangerous, as internal-only endpoints such as cloud metadata services
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2025Weblate is a web based localization tool.CVE-2025-64725 · Other software · WeblateOrg · reported by GitHubLow 1
Weblate is a web based localization tool. In versions prior to 5.15, it was possible to accept an invitation opened by a different user. Version 5.15. contains a patch. As a workaround, avoid leaving one's Weblate sessions with an invitation opened unattended.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2025Weblate is a web based localization tool.CVE-2025-64326 · Other software · WeblateOrg · reported by GitHubLow 2.6
Weblate is a web based localization tool. In versions 5.14 and below, Weblate leaks the IP address of the project member inviting the user to the project in the audit log. The audit log includes IP addresses from admin-triggered actions, which can be viewed by invited users. This issue is fixed in version 5.14.1.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2025Weblate is a web based localization tool.CVE-2025-61587 · Other software · WeblateOrg · reported by GitHubLow 2.1
Weblate is a web based localization tool. An open redirect exists in versions 5.13.2 and below via the redir parameter on .within.website when Weblate is configured with Anubis and REDIRECT_DOMAINS is not set. An attacker can craft a URL on the legitimate domain that redirects a victim to an attacker-controlled site. The redirect can also be used to initiate drive-by downloads (redirecting to a URL that serves a malicious file), increasing the risk to end users. This issue is fixed in version 5.13.3.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2025Weblate is a web based localization tool.CVE-2025-58352 · Other software · WeblateOrg · reported by GitHubLow 2.1
Weblate is a web based localization tool. Versions lower than 5.13.1 contain a vulnerability that causes long session expiry during the second factor verification. The long session expiry could be used to circumvent rate limiting of the second factor. This issue is fixed in version 5.13.1.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025Weblate is a web based localization tool.CVE-2025-49134 · Other software · WeblateOrg · reported by GitHubLow 2.1
Weblate is a web based localization tool. Prior to version 5.12, the audit log notifications included the full IP address of the acting user. This could be obtained by third-party servers such as SMTP relays, or spam filters. This issue has been patched in version 5.12.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2025Weblate is a web based localization tool.CVE-2025-47951 · Other software · WeblateOrg · reported by GitHubMedium 4.9
Weblate is a web based localization tool. Prior to version 5.12, the verification of the second factor was not subject to rate limiting. The absence of rate limiting on the second factor endpoint allows an attacker with valid credentials to automate OTP guessing. This issue has been patched in version 5.12.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2025Weblate is a web based localization tool.CVE-2025-32021 · Other software · WeblateOrg · reported by GitHubLow 2.2
Weblate is a web based localization tool. Prior to version 5.11, when creating a new component from an existing component that has a source code repository URL specified in settings, this URL is included in the client's URL parameters during the creation process. If, for example, the source code repository URL contains GitHub credentials, the confidential PAT and username are shown in plaintext and get saved into browser history. Moreover, if the request URL is logged, the credentials are written to logs in plaintext. If using Weblate official Docker image, nginx logs the URL and the token in plaintext. This issue is patched in version 5.11.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2024Weblate is a web based localization tool.CVE-2024-39303 · Other software · WeblateOrg · reported by GitHubMedium 4.4
Weblate is a web based localization tool. Prior to version 5.6.2, Weblate didn't correctly validate filenames when restoring project backup. It may be possible to gain unauthorized access to files on the server using a crafted ZIP file. This issue has been addressed in Weblate 5.6.2. As a workaround, do not allow untrusted users to create projects.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2022The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories.CVE-2022-23915 · Other software · Weblate · reported by report@snyk.ioHigh 7.2
The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution.
- Product
- Weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2022Weblate is a copyleft software web-based continuous localization system.CVE-2022-24710 · Other software · WeblateOrg · reported by GitHubMedium 5.4
Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutralize user input used in user name and language fields. Due to this improper neutralization it is possible to perform cross-site scripting via these fields. The issues were fixed in the 4.11 release. Users unable to upgrade are advised to add their own neutralize logic.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2017The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which aCVE-2017-5537 · Other software · Weblate · reported by MITREMedium 5.3
The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote attackers to enumerate user accounts via a series of requests.
- Product
- Weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.