Skip to content

Vendor

weblate vulnerabilities

37 published CVES affecting weblate, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
37
Critical
2
High
6
Medium
22
Low
7
Unscored
0
CISA KEV
0
Atom feed of weblate alerts

Products

Latest weblate CVEs

Newest publication first · page 1 of 2

  2. CVE-2026-44264 Weblate is vulnerable to XSS via crafted Markdown

    Published
    MediumCVSS 4.3 EPSS 0.27%

    Weblate is a web based localization tool. Prior to version 5.17.1, the Markdown renderer used in user comments and other user-provided content didn't properly sanitize some attributes. This issue has been patched in version 5.17.1.

  4. CVE-2026-41519 Weblate's API Token Not Invalidated on Password Change

    Published
    MediumCVSS 5.4 EPSS 0.27%

    Weblate is a web based localization tool. Prior to version 5.17.1, when a user changes their password, browser sessions are correctly invalidated via "cycle_session_keys()", but DRF API tokens ("wlu_*" prefix) stored in "authtoken_token" are not revoked. This issue has been patch...

  9. CVE-2026-34244 Weblate: SSRF via Project-Level Machinery Configuration

    Published
    MediumCVSS 5.0 EPSS 0.26%

    Weblate is a web based localization tool. In versions prior to 5.17, a user with the project.edit permission (granted by the per-project "Administration" role) can configure machine translation service URLs pointing to arbitrary internal network addresses. During configuration va...

  10. CVE-2026-34242 Weblate: Arbitrary File Read via Symlink

    Published
    HighCVSS 7.7 EPSS 0.48%

    Weblate is a web based localization tool. In versions prior to 5.17, the ZIP download feature didn't verify downloaded files, potentially following symlinks outside the repository. This issue has been fixed in version 5.17.

  12. CVE-2026-33435 Weblate: Remote code execution during backup restoration

    Published
    HighCVSS 8.1 EPSS 0.72%

    Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filter Git and Mercurial configuration files which could lead to remote code execution under certain circumstances. This issue has been fixed in version 5.17. If developers are unable t...

  14. CVE-2026-33214 Weblate has improper access control for the translation memory API

    Published
    MediumCVSS 4.3 EPSS 0.25%

    Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpoints, which in turn didn't enforce proper access control. This issue has been fixed in version 5.17. If users are unable to update immediately, they can work ar...

  15. CVE-2026-33212 Weblate: Improper access control for pending tasks in API

    Published
    LowCVSS 3.1 EPSS 0.23%

    Weblate is a web based localization tool. In versions prior to 5.17, the tasks API didn't verify user access for pending tasks. This could expose logs of in-progress operations to users who don't have access to given scope. The attacker needs to brute-force the random UUID of the...

  17. CVE-2026-24126 Weblate has an argument injection in management console

    Published
    CriticalCVSS 9.1 EPSS 0.52%

    Weblate is a web based localization tool. Prior to 5.16.0, the SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument injection to ssh-add. Version 5.16.0 fixes the issue. As a workaround, properly limit access to t...

  19. CVE-2026-21889 Weblate leaks information via screenshots

    Published
    LowCVSS 2.3 EPSS 0.39%

    Weblate is a web based localization tool. Prior to 5.15.2, the screenshot images were served directly by the HTTP server without proper access control. This could allow an unauthenticated user to access screenshots after guessing their filename. This vulnerability is fixed in 5.1...

  20. CVE-2026-22251 wlc may leak API keys due to an insecure API key configuration

    Published
    MediumCVSS 5.5 EPSS 0.19%

    wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, wlc supported providing unscoped API keys in the setting. This practice was discouraged for years, but the code was never removed. This might cause the API key to be leaked to different servers.

  21. CVE-2026-22250 wlc can skip SSL verification

    Published
    MediumCVSS 5.5 EPSS 0.15%

    wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, the SSL verification would be skipped for some crafted URLs. This vulnerability is fixed in 1.17.0.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.