weblate vulnerabilities — 75 matching vulnerabilities

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed — no installation and no source-code access required.

Scan your app free →
Severity Vulnerability Package Ecosystem Disclosed Fixed version
4.3 medium CVE-2026-55227: Weblate Object Existence Disclosure Vulnerability weblate PyPI 10 Sep 2026 2026.7
8.1 high CVE-2026-55228: Weblate IDOR Vulnerability Allows Unauthorized Access to Private Projects weblate PyPI 10 Sep 2026 2026.7
8.1 high CVE-2026-55228: Weblate IDOR Vulnerability Allows Unauthorized Access to Private Projects weblate PyPI 28 Aug 2026 2026.7
4.3 medium CVE-2026-55227: Weblate Package Exposes Object Existence Information via 403 Status Codes weblate PyPI 28 Aug 2026 2026.7
5.9 medium CVE-2026-50127: Weblate SSRF Vulnerability Allows Bypass of Private Range Restrictions weblate PyPI 13 Jul 2026 2026.6
4.6 medium CVE-2026-45106: Weblate Stored HTML Injection in Editor Search Preview weblate PyPI 13 Jul 2026 2026.5
5.9 medium CVE-2026-50127: Weblate SSRF Vulnerability in Outbound URL Guard weblate PyPI 07 Jul 2026 2026.6
2.3 low CVE-2026-21889: Weblate Information Leak via Unprotected Screenshots weblate PyPI 07 Jul 2026 5.15.2
7.7 high CVE-2025-68279: Weblate Arbitrary File Read via Symbolic Links weblate PyPI 07 Jul 2026 5.15.1
1.0 low CVE-2025-64725: Weblate Invitation Acceptance Vulnerability weblate PyPI 07 Jul 2026 5.15
2.1 low CVE-2025-58352: Weblate Long Session Expiry in Second Factor Verification weblate PyPI 07 Jul 2026 5.13.1
4.9 medium CVE-2025-47951: Weblate Second Factor Verification Lacks Rate Limiting weblate PyPI 07 Jul 2026 5.12
5.3 medium CVE-2025-49134: Weblate Exposes Personal IP Address via E-mail weblate PyPI 07 Jul 2026 5.12
4.4 medium CVE-2024-39303: Weblate Improper Sanitization of Project Backups weblate PyPI 07 Jul 2026 5.6.2
9.1 critical CVE-2025-68398: Weblate Remote Code Execution via Git Config File Overwrite weblate PyPI 29 Jun 2026 5.15.1
5.0 medium CVE-2025-66407: Weblate Server-Side Request Forgery Vulnerability weblate PyPI 26 May 2026 5.15
4.6 medium CVE-2026-45106: Weblate Stored HTML Injection in Editor Search Preview weblate PyPI 15 May 2026 2026.5
4.3 medium CVE-2026-44263: Weblate Vulnerability Allows Unauthorized Translation Enumeration weblate PyPI 07 May 2026 5.17.1
4.3 medium CVE-2026-44264: Weblate Markdown Renderer Improper Sanitization Vulnerability weblate PyPI 07 May 2026 5.17.1
8.1 high CVE-2026-41654: Weblate Package Allows Import of Malicious Project Backup ZIP Leading to Unauthorized Repo URL Access weblate PyPI 07 May 2026 5.17.1
Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

Searching the database

How do I search for a CVE or a package?

Type a CVE id, package name, ecosystem or keyword into the search field. Results include the severity, the affected package, the ecosystem, the disclosure date and the fixed version.

Can I filter by severity or by whether a fix exists?

Yes. The filters on the left narrow the list to critical, high, medium or low vulnerabilities, to a single ecosystem, and to vulnerabilities that have a fix available or none yet.

What does "No fix published" mean?

No patched version has been released for that vulnerability yet. The vulnerability page still shows the affected range and any workaround that can reduce exposure in the meantime.