Product by Weblateorg
Weblate
43 known vulnerabilities in Weblate (Weblateorg), 0 of them actively exploited (CISA KEV).
Key figures
43
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
3
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2025-68398 | Weblate has git config file overwrite vulnerability that leads to remote code execution | 9.1 | |
| High | CVE-2026-86035 | Weblate: OS Command Injection | 8.5 | |
| High | CVE-2026-61792 | Weblate: Path Traversal | 7.7 | |
| High | CVE-2026-33435 | Weblate: Remote code execution during backup restoration | 8.1 | |
| High | CVE-2026-55228 | Weblate: Authorization Bypass Through User-Controlled Key | 8.1 | |
| Medium | CVE-2026-62326 | Weblate Has Uncontrolled Resource Consumption via | 6.5 | |
| High | CVE-2026-34393 | Weblate: Privilege escalation in the user API endpoint | 8.8 | |
| High | CVE-2026-34242 | Weblate: Arbitrary File Read via Symlink | 7.7 | |
| Critical | CVE-2025-64725 | Weblate has improper validation upon invitation acceptance | 9.8 | |
| High | CVE-2026-41654 | Weblate is Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url | 8.1 | |
| Critical | CVE-2026-24126 | Weblate has an argument injection in management console | 6.6 | |
| High | CVE-2025-68279 | Weblate has an arbitrary file read via symbolic links | 7.7 | |
| Medium | CVE-2026-77507 | Weblate: Object-scoped RSS feeds disclose private change history to unauthorized users | 5.3 | |
| High | CVE-2026-21889 | Weblate leaks information via screenshots | 7.5 | |
| Medium | CVE-2026-33220 | Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository | 6.8 | |
| Medium | CVE-2026-61790 | Weblate: Team-enforced 2FA is bypassed for global permissions | 4.4 | |
| Medium | CVE-2022-24710 | Cross-site Scripting in Weblate | 5.4 | |
| Medium | CVE-2026-50127 | Weblate SSRF: outbound URL guard misses the NAT64 well-known prefix (64:ff9b::/96) | 5.9 | |
| Medium | CVE-2025-61587 | Weblate integration with Anubis can lead to Open Redirect via redir parameter | 6.1 | |
| Medium | CVE-2026-55227 | Weblate: Observable Discrepancy | 4.3 | |
| Medium | CVE-2026-62249 | Weblate: Exposure of Sensitive Information to an Unauthorized Actor | 4.3 | |
| Medium | CVE-2025-58352 | Weblate has long session expiry times during second factor verification | 6.5 | |
| Medium | CVE-2026-40256 | Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision | 5.0 | |
| Medium | CVE-2026-44263 | Weblate: Private Translation Enumeration via Screenshot API | 4.3 | |
| Medium | CVE-2026-34244 | Weblate: SSRF via Project-Level Machinery Configuration | 5.0 |