Low
CVE-2026-62364
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41
Reset filters
Medium
CVE-2026-55227
Private Weblate projects vulnerable to observable object existence disclosure via globally scoped object lookups
High
CVE-2026-55228
Weblate has IDOR in GroupViewSet that allows authenticated project manager to gain unauthorized read access to any private project
Medium
CVE-2026-50127
Weblate SSRF: outbound URL guard misses some private ranges
Medium
CVE-2026-45106
Weblate: Stored HTML injection in editor search preview
Low
CVE-2026-21889
Weblate leaks information via screenshots
High
CVE-2026-23535
Weblate wlc path traversal vulnerability: Unsanitized API slugs in download command
Medium
CVE-2026-22251
Weblate wlc has insecure API key configuration
Low
CVE-2026-22250
Weblate command-line client susceptible to SSL verification skip
High
CVE-2025-68279
Weblate has an arbitrary file read via symbolic links
Low
CVE-2025-64725
Weblate has improper validation upon invitation acceptance
Low
CVE-2025-58352
Weblate has a long session expiry when verifying second factor
Medium
CVE-2025-47951
Weblate lacks rate limiting when verifying second factor
Low
CVE-2025-49134
Weblate exposes personal IP address via e-mail
Low
CVE-2024-39303
Weblate vulnerable to improper sanitization of project backups
Medium
CVE-2026-42150
wlc: print_html outputs API data without HTML escaping
Medium
CVE-2026-44263
Weblate Vulnerable to Private Translation Enumeration via Screenshot API
Medium
CVE-2026-44264
Weblate vulnerable to XSS via crafted Markdown
Medium
CVE-2026-41654
Weblate Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url
Medium
CVE-2026-41519
Weblate Doesn't Invalidate API Token on Password Change
Medium
CVE-2026-40256
Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision
Medium
CVE-2026-39845
Weblate: SSRF via the webhook add-on using unprotected fetch_url()
High
CVE-2026-34393
Weblate: Privilege escalation in the user API endpoint
High
CVE-2026-34242
Weblate: Arbitrary File Read via Symlink
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.