Vendor
Weblate
37 known vulnerabilities in products by Weblate, 0 of them actively exploited (CISA KEV).
Key figures
37
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
3
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2022-23915 | Remote Code Execution (RCE) | 7.2 | |
| Critical | CVE-2025-68398 | Weblate has git config file overwrite vulnerability that leads to remote code execution | 9.1 | |
| Medium | CVE-2017-5537 | Weblate: security vulnerability | 5.3 | |
| High | CVE-2026-33435 | Weblate: Remote code execution during backup restoration | 8.1 | |
| High | CVE-2026-34393 | Weblate: Privilege escalation in the user API endpoint | 8.8 | |
| High | CVE-2026-34242 | Weblate: Arbitrary File Read via Symlink | 7.7 | |
| Critical | CVE-2025-64725 | Weblate has improper validation upon invitation acceptance | 9.8 | |
| High | CVE-2026-41654 | Weblate is Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url | 8.1 | |
| Critical | CVE-2026-24126 | Weblate has an argument injection in management console | 6.6 | |
| High | CVE-2026-23535 | wlc Path traversal: Unsanitized API slugs in download command | 8.1 | |
| High | CVE-2025-68279 | Weblate has an arbitrary file read via symbolic links | 7.7 | |
| High | CVE-2026-21889 | Weblate leaks information via screenshots | 7.5 | |
| Medium | CVE-2026-33220 | Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository | 6.8 | |
| Medium | CVE-2022-24710 | Cross-site Scripting in Weblate | 5.4 | |
| Medium | CVE-2025-61587 | Weblate integration with Anubis can lead to Open Redirect via redir parameter | 6.1 | |
| Medium | CVE-2026-40256 | Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision | 5.0 | |
| Medium | CVE-2025-58352 | Weblate has long session expiry times during second factor verification | 6.5 | |
| Medium | CVE-2026-34244 | Weblate: SSRF via Project-Level Machinery Configuration | 5.0 | |
| Medium | CVE-2026-44263 | Weblate: Private Translation Enumeration via Screenshot API | 4.3 | |
| Medium | CVE-2026-33440 | Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads | 5.0 | |
| Medium | CVE-2026-27457 | Weblate: Missing access control for the AddonViewSet API exposes all addon configurations | 4.3 | |
| Medium | CVE-2026-42150 | wlc: print_html outputs API data without HTML escaping, enabling stored XSS | 5.1 | |
| Medium | CVE-2025-49134 | Weblate exposes personal IP address via e-mail | 5.3 | |
| Medium | CVE-2025-67492 | Weblate's over‑permissive webhook endpoint enables mass repository updates and component enumeration | 5.3 | |
| Medium | CVE-2026-44264 | Weblate is vulnerable to XSS via crafted Markdown | 4.3 |