Weblate-CVE-2026-24126

Weblate — Arbitrary File Read via SSH Host Argument Injection Discovered by: Alejandro Baño · January 2026 Acknowledged by: Weblate 5.16 release notes Overview Weblate's SSH host key management endpoint passes the host parameter supplied by an authenticated administrator directly tossh-keyscan...

perceval-opnfv (>=0.2.2rc1, <=0.2.2rc2), perceval-puppet (>=0.2.2rc1, <=0.2.2rc2) +1 more potentially affected by unknown CVE via dulwich (0.20.34)

dulwich PYPI version 0.20.34 is affected by a known vulnerability. The following packages have a transitive dependency on dulwich and may be impacted: - perceval-opnfv =0.2.2rc1, =0.2.2rc1, =0.2.2rc1, =0.2.2rc2 Source cves: unknown CVE Source advisory: OSV:GHSA-8MCX-5RQC-VHMF...

perceval-opnfv (>=0.2.2rc1, <=0.2.2rc2), perceval-puppet (>=0.2.2rc1, <=0.2.2rc2) +1 more potentially affected by unknown CVE via dulwich (0.20.34)

dulwich PYPI version 0.20.34 is affected by a known vulnerability. The following packages have a transitive dependency on dulwich and may be impacted: - perceval-opnfv =0.2.2rc1, =0.2.2rc1, =0.2.2rc1, =0.2.2rc2 Source cves: unknown CVE Source advisory: OSV:GHSA-35MR-4567-66VG...

edx-oauth2-wordpress-backend (>=1.0.0, <=1.0.4), richie (>=2.13.0, <=2.14.1) +2 more potentially affected by CVE-2026-57175 via social-auth-core (4.2.0)

social-auth-core PYPI version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - edx-oauth2-wordpress-backend =1.0.0, =2.13.0, =14.0.0, =4.11.0, =4.12.2 Source cves: CVE-2026-57175 Source advisory:...

edx-oauth2-wordpress-backend (>=1.0.0, <=1.0.4), richie (>=2.13.0, <=2.14.1) +2 more potentially affected by CVE-2026-57176 via social-auth-core (4.2.0)

social-auth-core PYPI version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - edx-oauth2-wordpress-backend =1.0.0, =2.13.0, =14.0.0, =4.11.0, =4.12.2 Source cves: CVE-2026-57176 Source advisory:...

edx-oauth2-wordpress-backend (>=1.0.0, <=1.0.4), richie (>=2.13.0, <=2.14.1) +2 more potentially affected by CVE-2026-57179 via social-auth-core (4.2.0)

social-auth-core PYPI version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - edx-oauth2-wordpress-backend =1.0.0, =2.13.0, =14.0.0, =4.11.0, =4.12.2 Source cves: CVE-2026-57179 Source advisory:...

richie (>=2.8.0, <=2.12.0), weblate (>=4.9.0, <=4.10.1) potentially affected by CVE-2026-57179 via social-auth-core (4.1.0)

social-auth-core PYPI version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - richie =2.8.0, =4.9.0, =4.10.1 Source cves: CVE-2026-57179 Source advisory: OSV:PYSEC-2026-4168...

galaxy (>=25.1.0, <=25.1.2), galaxy-ng (>=4.8.0, <=4.9.2) +6 more potentially affected by CVE-2026-57179 via social-auth-core (4.7.0)

social-auth-core PYPI version 4.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - galaxy =25.1.0, =4.8.0, =0.9.0, =1.40.0, =1.111.0, =1.2.6, =4.16.3, =5.5.5 - weblate-fedora-messaging 0.6.0 Source cves:...

argus-server (>=1.23.0, <=1.34.1), bitcaster (>=2.1.0rc1, <=2.2.0) +14 more potentially affected by CVE-2026-57179 via social-auth-core (4.8.7)

social-auth-core PYPI version 4.8.7 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - argus-server =1.23.0, =2.1.0rc1, =2.4.6, =2.0.9, =1.0.1, =0.16.0, =2024.1.0, =1.62.0, =5.7.0, =0.10.0, =5.6.0, =0.1.0, =0.12.0 a...

richie (>=2.8.0, <=2.12.0), weblate (>=4.9.0, <=4.10.1) potentially affected by CVE-2026-57177 via social-auth-core (4.1.0)

social-auth-core PYPI version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - richie =2.8.0, =4.9.0, =4.10.1 Source cves: CVE-2026-57177 Source advisory: OSV:PYSEC-2026-4169...

edx-oauth2-wordpress-backend (>=1.0.0, <=1.0.4), richie (>=2.13.0, <=2.14.1) +2 more potentially affected by CVE-2026-57177 via social-auth-core (4.2.0)

social-auth-core PYPI version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - edx-oauth2-wordpress-backend =1.0.0, =2.13.0, =14.0.0, =4.11.0, =4.12.2 Source cves: CVE-2026-57177 Source advisory:...

galaxy (>=25.1.0, <=25.1.2), galaxy-ng (>=4.8.0, <=4.9.2) +6 more potentially affected by CVE-2026-57176 via social-auth-core (4.7.0)

social-auth-core PYPI version 4.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - galaxy =25.1.0, =4.8.0, =0.9.0, =1.40.0, =1.111.0, =1.2.6, =4.16.3, =5.5.5 - weblate-fedora-messaging 0.6.0 Source cves:...

galaxy (>=25.1.0, <=25.1.2), galaxy-ng (>=4.8.0, <=4.9.2) +6 more potentially affected by CVE-2026-57175 via social-auth-core (4.7.0)

social-auth-core PYPI version 4.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - galaxy =25.1.0, =4.8.0, =0.9.0, =1.40.0, =1.111.0, =1.2.6, =4.16.3, =5.5.5 - weblate-fedora-messaging 0.6.0 Source cves:...

galaxy (>=25.1.0, <=25.1.2), galaxy-ng (>=4.8.0, <=4.9.2) +6 more potentially affected by CVE-2026-57178 via social-auth-core (4.7.0)

social-auth-core PYPI version 4.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - galaxy =25.1.0, =4.8.0, =0.9.0, =1.40.0, =1.111.0, =1.2.6, =4.16.3, =5.5.5 - weblate-fedora-messaging 0.6.0 Source cves:...

argus-server (>=1.23.0, <=1.34.1), bitcaster (>=2.1.0rc1, <=2.2.0) +14 more potentially affected by CVE-2026-57178 via social-auth-core (4.8.7)

social-auth-core PYPI version 4.8.7 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - argus-server =1.23.0, =2.1.0rc1, =2.4.6, =2.0.9, =1.0.1, =0.16.0, =2024.1.0, =1.62.0, =5.7.0, =0.10.0, =5.6.0, =0.1.0, =0.12.0 a...

richie (>=2.8.0, <=2.12.0), weblate (>=4.9.0, <=4.10.1) potentially affected by CVE-2026-57178 via social-auth-core (4.1.0)

social-auth-core PYPI version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - richie =2.8.0, =4.9.0, =4.10.1 Source cves: CVE-2026-57178 Source advisory: OSV:PYSEC-2026-4165...

edx-oauth2-wordpress-backend (>=1.0.0, <=1.0.4), richie (>=2.13.0, <=2.14.1) +2 more potentially affected by CVE-2026-57178 via social-auth-core (4.2.0)

social-auth-core PYPI version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - edx-oauth2-wordpress-backend =1.0.0, =2.13.0, =14.0.0, =4.11.0, =4.12.2 Source cves: CVE-2026-57178 Source advisory:...

richie (>=2.8.0, <=2.12.0), weblate (>=4.9.0, <=4.10.1) potentially affected by CVE-2026-57176 via social-auth-core (4.1.0)

social-auth-core PYPI version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - richie =2.8.0, =4.9.0, =4.10.1 Source cves: CVE-2026-57176 Source advisory: OSV:PYSEC-2026-4166...

PYSEC-2026-4180 wlc may disclose API tokens to project-configured URLs

Impact wlc could send an unscoped API token to an unintended server when run inside a directory tree containing attacker-controlled project configuration. If .weblate, .weblate.ini, or weblate.ini defines an API url, and the user supplies a token with WLCKEY or --key without also pinning the URL,...

CVE-2026-86035

Weblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 2026.7.1 contains an argument-injection vulnerability in its Mercurial backend. Repository filenames beginning with - could be interpreted as Mercurial options instead of literal...