Weblate

Weblate

19 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
4.3

CVE-2026-27457

  • EPSS 0.02%
  • Veröffentlicht 26.02.2026 21:56:03
  • Zuletzt bearbeitet 27.02.2026 17:05:12

Weblate is a web based localization tool. Prior to version 5.16.1, the REST API's `AddonViewSet` (`weblate/api/views.py`, line 2831) uses `queryset = Addon.objects.all()` without overriding `get_queryset()` to scope results by user permissions. This ...

9.1

CVE-2026-24126

  • EPSS 0.02%
  • Veröffentlicht 18.02.2026 23:05:03
  • Zuletzt bearbeitet 19.02.2026 18:34:57

Weblate is a web based localization tool. Prior to 5.16.0, the SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument injection to `ssh-add`. Version 5.16.0 fixes the issue. As a workar...

7.5

CVE-2026-21889

  • EPSS 0.04%
  • Veröffentlicht 14.01.2026 16:28:30
  • Zuletzt bearbeitet 23.01.2026 14:49:52

Weblate is a web based localization tool. Prior to 5.15.2, the screenshot images were served directly by the HTTP server without proper access control. This could allow an unauthenticated user to access screenshots after guessing their filename. This...

9.1

CVE-2025-68398

  • EPSS 0.24%
  • Veröffentlicht 18.12.2025 23:00:57
  • Zuletzt bearbeitet 06.02.2026 20:16:08

Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to overwrite Git configuration remotely and override some of its behavior. Version 5.15.1 fixes the issue.

6.5

CVE-2025-68279

  • EPSS 0.07%
  • Veröffentlicht 18.12.2025 22:59:28
  • Zuletzt bearbeitet 02.01.2026 16:33:54

Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to read arbitrary files from the server file system using crafted symbolic links in the repository. Version 5.15.1 fixes the issue.

4.3

CVE-2025-67715

  • EPSS 0.01%
  • Veröffentlicht 16.12.2025 00:07:42
  • Zuletzt bearbeitet 17.12.2025 16:01:18

Weblate is a web based localization tool. In versions prior to 5.15, it was possible to retrieve user notification settings or list all users via API. Version 5.15 fixes the issue.

5.3

CVE-2025-67492

  • EPSS 0.03%
  • Veröffentlicht 16.12.2025 00:05:56
  • Zuletzt bearbeitet 17.12.2025 16:03:45

Weblate is a web based localization tool. In versions prior to 5.15, it was possible to trigger repository updates for many repositories via a crafted webhook payload. Version 5.15 fixes the issue. As a workaround, disabling webhooks completely using...

5

CVE-2025-66407

  • EPSS 0.02%
  • Veröffentlicht 15.12.2025 23:36:25
  • Zuletzt bearbeitet 12.01.2026 17:25:01

Weblate is a web based localization tool. The Create Component functionality in Weblate allows authorized users to add new translation components by specifying both a version control system and a source code repository URL to pull from. However, prio...

9.8

CVE-2025-64725

  • EPSS 0.01%
  • Veröffentlicht 15.12.2025 20:21:06
  • Zuletzt bearbeitet 18.12.2025 21:25:11

Weblate is a web based localization tool. In versions prior to 5.15, it was possible to accept an invitation opened by a different user. Version 5.15. contains a patch. As a workaround, avoid leaving one's Weblate sessions with an invitation opened u...

3.5

CVE-2025-64326

  • EPSS 0.04%
  • Veröffentlicht 06.11.2025 20:55:17
  • Zuletzt bearbeitet 04.12.2025 21:35:38

Weblate is a web based localization tool. In versions 5.14 and below, Weblate leaks the IP address of the project member inviting the user to the project in the audit log. The audit log includes IP addresses from admin-triggered actions, which can b...