Weblate-CVE-2026-24126

Weblate — Arbitrary File Read via SSH Host Argument Injection Discovered by: Alejandro Baño · January 2026 Acknowledged by: Weblate 5.16 release notes Overview Weblate's SSH host key management endpoint passes the host parameter supplied by an authenticated administrator directly tossh-keyscan...

weblate (2026.10.1) potentially affected by CVE-2026-115910 via social-auth-core (6.1.0)

social-auth-core PYPI version 6.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - weblate 2026.10.1 Source cves: CVE-2026-115910 Source advisory: MEND:CVE-2026-115910...

gam7 (>=7.48.17, <=7.49.5), inference-core (>=1.2.7, <=1.6.0) +4 more potentially affected by CVE-2026-112936 via filelock (>=4.0.0, <=4.0.8)

filelock PYPI version =4.0.0, =7.48.17, =1.2.7, =0.3.0, =2.2.0, =3.2.7 - vulpix 2.1.0 - weblate 2026.10.0 Source cves: CVE-2026-112936 Source advisory: MEND:CVE-2026-112936...

astrapi-backup (>=26.8.1, <=26.8.16), b9gemyaeix (>=4.14.0, <=4.14.1) +5 more potentially affected by CVE-2026-62268 via borgbackup (>=1.1.13, <=1.4.4)

borgbackup PYPI version =1.1.13, =26.8.1, =4.14.0, =0.1.3.dev1, =0.12.0, =4.9.0, =2026.7.1 - weblate-fedora-messaging 0.6.0 Source cves: CVE-2026-62268 Source advisory: MEND:CVE-2026-62268...

astrapi-backup (>=26.8.1, <=26.8.16), b9gemyaeix (>=4.14.0, <=4.14.1) +5 more potentially affected by CVE-2026-62268 via borgbackup (>=1.1.13, <=1.4.4)

borgbackup PYPI version =1.1.13, =26.8.1, =4.14.0, =0.1.3.dev1, =0.12.0, =4.9.0, =2026.7.1 - weblate-fedora-messaging 0.6.0 Source cves: CVE-2026-62268 Source advisory: OSV:GHSA-GFP8-W835-V44J...

Weblate 5.15.2 SSH Keyscan Argument Injection

Weblate versions prior to 5.16.0 contain an argument injection in the SSH management console. An authenticated administrator can use the supplied proof of concept to cause ssh-keyscan to read a server-local file and reflect its contents in error output. https://packetstorm.news/download/235840...

CVE-2026-86042

Impact An authenticated user who can import project backups can craft a backup containing a "weblate://" repository link to a component they cannot access. During restoration, Weblate did not enforce the component.edit permission check used by the normal UI and API. The imported component could...

PYSEC-2026-4180 wlc may disclose API tokens to project-configured URLs

Impact wlc could send an unscoped API token to an unintended server when run inside a directory tree containing attacker-controlled project configuration. If .weblate, .weblate.ini, or weblate.ini defines an API url, and the user supplies a token with WLCKEY or --key without also pinning the URL,...

CVE-2026-86035

Weblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 2026.7.1 contains an argument-injection vulnerability in its Mercurial backend. Repository filenames beginning with - could be interpreted as Mercurial options instead of literal...

CVE-2026-86035

Weblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 2026.7.1 contains an argument-injection vulnerability in its Mercurial backend. Repository filenames beginning with - could be interpreted as Mercurial options instead of literal...

EUVD-2026-88976

Weblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 2026.7.1 contains an argument-injection vulnerability in its Mercurial backend. Repository filenames beginning with - could be interpreted as Mercurial options instead of literal...

CVE-2026-86035 Weblate: Mercurial argument injection via repository filenames allows authenticated command execution

Weblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 2026.7.1 contains an argument-injection vulnerability in its Mercurial backend. Repository filenames beginning with - could be interpreted as Mercurial options instead of literal...

CVE-2026-86035

Weblate versions 4.11.1 through 2026.7.1 are vulnerable to an argument-injection flaw in the Mercurial backend . The root cause is that repository filenames starting with a hyphen (-) may be misinterpreted as Mercurial options rather than literal paths. An authenticated user with component.edit p...

CVE-2026-86035 Weblate: Mercurial argument injection via repository filenames allows authenticated command execution

Weblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 2026.7.1 contains an argument-injection vulnerability in its Mercurial backend. Repository filenames beginning with - could be interpreted as Mercurial options instead of literal...

CVE-2026-86035 Weblate: Mercurial argument injection via repository filenames allows authenticated command execution

Weblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 2026.7.1 contains an argument-injection vulnerability in its Mercurial backend. Repository filenames beginning with - could be interpreted as Mercurial options instead of literal...

PT-2026-102639

Name of the Vulnerable Software and Affected Versions Weblate versions 4.11.1 through 2026.7.1 Description An argument-injection flaw exists in the Mercurial backend of this web-based continuous localization platform. Repository filenames starting with a hyphen - may be interpreted as Mercurial...

CVE-2026-86035: Improper Neutralization of Special Elements used in an OS Command

Weblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 2026.7.1 contains an argument-injection vulnerability in its Mercurial backend. Repository filenames beginning with - could be interpreted as Mercurial options instead of literal...

UBUNTU-CVE-2026-62364

wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through WLCKEY or --key without a matching WLCURL or --url. When wlc run...

CVE-2026-62364 wlc may disclose API tokens to project-configured URLs

wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through WLCKEY or --key without a matching WLCURL or --url. When wlc run...

CVE-2026-62364 wlc may disclose API tokens to project-configured URLs

wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through WLCKEY or --key without a matching WLCURL or --url. When wlc run...