Medium
CVE-2026-34244
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41
Reset filters
Medium
CVE-2026-33440
Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads
High
CVE-2026-33435
Weblate: Remote code execution during backup restoration
Medium
CVE-2026-33220
Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository
Medium
CVE-2026-33214
Weblate: Improper access control for the translation memory in API
Low
CVE-2026-33212
Weblate: Improper access control for pending tasks in API
Medium
CVE-2026-27457
Weblate: Missing access control for the AddonViewSet API exposes all addon configurations
Medium
CVE-2026-24126
Weblate has an argument injection in management console
Critical
CVE-2025-68398
Weblate is vulnerable to RCE through Git config file overwrite
Medium
CVE-2025-67715
Weblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR)
Medium
CVE-2025-67492
Weblate's over‑permissive webhook endpoint enables mass repository updates and component enumeration
Medium
CVE-2025-66407
Weblate has a Server-Side Request Forgery issue
Low
CVE-2025-64326
Weblate leaks the IP of project member inviting user to be reviewer in Audit log
Medium
CVE-2025-61587
Weblate is a web based localization tool. An open redirect exists in versions 5.13.2 and below via the redir parameter on .within.website when Weblate is configured with Anubis and REDIRECT_DOMAINS is
High
CVE-2025-32021
Weblate is a web based localization tool. Prior to version 5.11, when creating a new component from an existing component that has a source code repository URL specified in settings, this URL is inclu
Medium
CVE-2017-5537
The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote attackers to enumerate user
Medium
CVE-2022-24710
Cross-site Scripting in Weblate
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.