Approved changes feed: RSS · Atom
cpe:2.3:a:weblateorg:weblate:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Weblateorg (e83b8be7-9de9-5d04-9ff2-7f0b54ff1463) |
|---|---|
| Product | Weblate (dbde9ece-2078-59e6-b09f-07c6888e59dc) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-50127 |
vulnerable | 2026-07-29 00:57:47.569902 |
Weblate SSRF: outbound URL guard misses the NAT64 well-known prefix (64:ff9b::/96)
MEDIUM (5.9)
Weblate is a web based localization tool. From version 5.15 to before version 2026.6, Weblate's VCS_RESTRICT_PRIVATE did not properly account for some transitional IPv6 ranges, multicast addresses, or some semi-private IPv4 ranges, which allowed some addresses to bypass private range restrictions. This issue has been patched in version 2026.6.
Published: 2026-06-10T19:56:37.829Z
Updated: 2026-06-11T14:09:55.504Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-45106 |
vulnerable | 2026-07-29 00:52:15.084628 |
Weblate: Stored HTML injection in editor search preview
MEDIUM (4.6)
Weblate is a web based localization tool. Prior to version 2026.5, Weblate's live search preview renders unit source and context as HTML without escaping. Any contributor whose content reaches those fields stores HTML and CSS that runs inside the authenticated editor of every user who runs a matching search. This issue has been patched in version 2026.5.
Published: 2026-06-10T19:56:49.797Z
Updated: 2026-06-11T14:05:00.742Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44264 |
vulnerable | 2026-06-08 08:03:18.171143 |
Weblate is vulnerable to XSS via crafted Markdown
MEDIUM (4.3)
Weblate is a web based localization tool. Prior to version 5.17.1, the Markdown renderer used in user comments and other user-provided content didn't properly sanitize some attributes. This issue has been patched in version 5.17.1.
Published: 2026-05-07T13:43:30.726Z
Updated: 2026-05-07T15:05:39.272Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44263 |
vulnerable | 2026-06-08 08:03:18.170864 |
Weblate: Private Translation Enumeration via Screenshot API
MEDIUM (4.3)
Weblate is a web based localization tool. Prior to version 5.17.1, the screenshots, tasks, and component link API allowed for the enumeration of translations in a project inaccessible to the user. This issue has been patched in version 5.17.1.
Published: 2026-05-07T13:42:46.706Z
Updated: 2026-05-07T15:02:08.282Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41654 |
vulnerable | 2026-06-08 08:03:15.654952 |
Weblate is Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url
Weblate is a web based localization tool. Prior to version 5.17.1, an authenticated user with project.add permission (default on hosted Weblate SaaS and for any user holding an active billing/trial plan) can import a crafted project backup ZIP whose components/<name>.json contains an attacker-chosen repo URL pointing at a private address (e.g. http://127.0.0.1:9999/) or using a non-allow-listed scheme (e.g. file://, git://). Weblate persists the component via Component.objects.bulk_create([component])[0], which bypasses Django's full_clean() and therefore never runs the validate_repo_url validator. The URL is subsequently written verbatim into .git/config by configure_repo(pull=False). This issue has been patched in version 5.17.1.
Published: 2026-05-07T13:40:12.532Z
Updated: 2026-05-08T14:23:41.296Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41519 |
vulnerable | 2026-06-08 08:03:15.534174 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-40256 |
vulnerable | 2026-06-08 08:01:20.096029 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-39845 |
vulnerable | 2026-06-08 08:01:17.093233 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34393 |
vulnerable | 2026-06-08 07:59:12.468362 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34244 |
vulnerable | 2026-06-08 07:59:11.950123 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34242 |
vulnerable | 2026-06-08 07:59:11.939194 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33440 |
vulnerable | 2026-06-08 07:59:09.978749 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33435 |
vulnerable | 2026-06-08 07:59:09.971648 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33220 |
vulnerable | 2026-06-08 07:59:09.369797 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33214 |
vulnerable | 2026-06-08 07:59:09.363294 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33212 |
vulnerable | 2026-06-08 07:59:09.361582 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27457 |
vulnerable | 2026-06-08 07:53:22.337137 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-24126 |
vulnerable | 2026-06-08 07:51:17.167989 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-21889 |
vulnerable | 2026-06-08 07:49:16.953804 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-68398 |
vulnerable | 2026-06-08 07:41:21.097350 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-68279 |
vulnerable | 2026-06-08 07:41:21.010693 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-67715 |
vulnerable | 2026-06-08 07:41:20.354227 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-67492 |
vulnerable | 2026-06-08 07:41:19.897948 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-66407 |
vulnerable | 2026-06-08 07:41:18.879298 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-64725 |
vulnerable | 2026-06-08 07:39:20.201531 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-64326 |
vulnerable | 2026-06-08 07:39:18.385311 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-61587 |
vulnerable | 2026-06-08 07:37:27.597923 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-58352 |
vulnerable | 2026-06-08 07:35:18.023176 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-49134 |
vulnerable | 2026-06-08 07:29:12.604938 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-47951 |
vulnerable | 2026-06-08 07:27:15.108473 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-32021 |
vulnerable | 2026-06-08 07:18:58.962717 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-39303 |
vulnerable | 2026-06-08 06:41:49.023512 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-24710 |
vulnerable | 2026-06-08 05:41:01.409759 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.