weblate-fedora-messaging (>=0.1.0, <=0.12.0), wlhosted (>=2024.11.0, <=2025.1.0) potentially affected by CVE-2026-77573 via weblate (>=5.4.3, <=5.16.2)

weblate PYPI version =5.4.3, =0.1.0, =2024.11.0, =2025.1.0 Source cves: CVE-2026-77573 Source advisory: MEND:CVE-2026-77573...

CVE-2026-77573 Weblate: DNS rebinding in VCS operations allows server-side request forgery

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, a user permitted to manage component repository URLs can perform server-side request forgery against internal services through DNS rebinding during VCS operations. Weblate...

CVE-2026-77573

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, a user permitted to manage component repository URLs can perform server-side request forgery against internal services through DNS rebinding during VCS operations. Weblate...

CVE-2026-77507 Weblate: Object-scoped RSS feeds disclose private change history to unauthorized users

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, Weblate's object-scoped RSS feeds do not apply the permission checks used elsewhere, allowing unauthorized users to read change-history metadata from private projects and...

EUVD-2026-66720

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, Weblate's object-scoped RSS feeds do not apply the permission checks used elsewhere, allowing unauthorized users to read change-history metadata from private projects and...

CVE-2026-77507 Weblate: Object-scoped RSS feeds disclose private change history to unauthorized users

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, Weblate's object-scoped RSS feeds do not apply the permission checks used elsewhere, allowing unauthorized users to read change-history metadata from private projects and...

weblate-fedora-messaging (>=0.1.0, <=0.12.0), wlhosted (>=2024.11.0, <=2025.1.0) potentially affected by CVE-2026-77507 via weblate (>=5.4.3, <=5.16.2)

weblate PYPI version =5.4.3, =0.1.0, =2024.11.0, =2025.1.0 Source cves: CVE-2026-77507 Source advisory: MEND:CVE-2026-77507...

CVE-2026-77507

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, Weblate's object-scoped RSS feeds do not apply the permission checks used elsewhere, allowing unauthorized users to read change-history metadata from private projects and...

CVE-2026-77507

Weblate , a web-based continuous localization platform, is affected by an information disclosure vulnerability in its object-scoped RSS feeds prior to version 2026.8 . The root cause is that these feeds fail to enforce the permission checks applied elsewhere, allowing unauthorized users to read c...

CVE-2026-77507 Weblate: Object-scoped RSS feeds disclose private change history to unauthorized users

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, Weblate's object-scoped RSS feeds do not apply the permission checks used elsewhere, allowing unauthorized users to read change-history metadata from private projects and...

CVE-2026-62326 Weblate Has Uncontrolled Resource Consumption via

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a user with the built-in "Edit source" role can store a malicious regular expression in a source string's flags that is executed without any timeout, allowing them to stall...

CVE-2026-62326 Weblate Has Uncontrolled Resource Consumption via

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a user with the built-in "Edit source" role can store a malicious regular expression in a source string's flags that is executed without any timeout, allowing them to stall...

CVE-2026-62326

Weblate , a web-based continuous localization platform, contains an uncontrolled resource consumption vulnerability in versions prior to 2026.7 . A user with the built-in "Edit source" role can store a malicious regular expression in a source string's flags (via the regex: quality check or regex ...

EUVD-2026-66718

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a user with the built-in "Edit source" role can store a malicious regular expression in a source string's flags that is executed without any timeout, allowing them to stall...

CVE-2026-62326 Weblate Has Uncontrolled Resource Consumption via

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a user with the built-in "Edit source" role can store a malicious regular expression in a source string's flags that is executed without any timeout, allowing them to stall...

CVE-2026-62326

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a user with the built-in "Edit source" role can store a malicious regular expression in a source string's flags that is executed without any timeout, allowing them to stall...

weblate-fedora-messaging (>=0.1.0, <=0.12.0), wlhosted (>=2024.11.0, <=2025.1.0) potentially affected by CVE-2026-62326 via weblate (>=5.4.3, <=5.16.2)

weblate PYPI version =5.4.3, =0.1.0, =2024.11.0, =2025.1.0 Source cves: CVE-2026-62326 Source advisory: MEND:CVE-2026-62326...

EUVD-2026-66717

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, an authenticated user with access to a project can retrieve the change history of restricted components in that project through nested API change endpoints, even without...

weblate-fedora-messaging (>=0.1.0, <=0.12.0), wlhosted (>=2024.11.0, <=2025.1.0) potentially affected by CVE-2026-62249 via weblate (>=5.4.3, <=5.16.2)

weblate PYPI version =5.4.3, =0.1.0, =2024.11.0, =2025.1.0 Source cves: CVE-2026-62249 Source advisory: MEND:CVE-2026-62249...

CVE-2026-62249 Weblate: Restricted-component change history leaked to non-member project users through the nested `GET /api/projects/{slug}/changes/` endpoint

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, an authenticated user with access to a project can retrieve the change history of restricted components in that project through nested API change endpoints, even without...