Weblate-CVE-2026-24126

Weblate — Arbitrary File Read via SSH Host Argument Injection Discovered by: Alejandro Baño · January 2026 Acknowledged by: Weblate 5.16 release notes Overview Weblate's SSH host key management endpoint passes the host parameter supplied by an authenticated administrator directly tossh-keyscan...

gam7 (>=7.48.17, <=7.49.0), inference-core (>=1.2.7, <=1.6.0) +3 more potentially affected by CVE-2026-112936 via filelock (>=4.0.0, <=4.0.8)

filelock PYPI version =4.0.0, =7.48.17, =1.2.7, =0.3.0, =2.2.0, =3.2.4 - weblate 2026.10.0 Source cves: CVE-2026-112936 Source advisory: MEND:CVE-2026-112936...

astrapi-backup (>=26.8.1, <=26.8.16), b9gemyaeix (>=4.14.0, <=4.14.1) +5 more potentially affected by CVE-2026-62268 via borgbackup (>=1.1.13, <=1.4.4)

borgbackup PYPI version =1.1.13, =26.8.1, =4.14.0, =0.1.3.dev1, =0.12.0, =4.9.0, =2026.7.1 - weblate-fedora-messaging 0.6.0 Source cves: CVE-2026-62268 Source advisory: MEND:CVE-2026-62268...

astrapi-backup (>=26.8.1, <=26.8.16), b9gemyaeix (>=4.14.0, <=4.14.1) +5 more potentially affected by CVE-2026-62268 via borgbackup (>=1.1.13, <=1.4.4)

borgbackup PYPI version =1.1.13, =26.8.1, =4.14.0, =0.1.3.dev1, =0.12.0, =4.9.0, =2026.7.1 - weblate-fedora-messaging 0.6.0 Source cves: CVE-2026-62268 Source advisory: OSV:GHSA-GFP8-W835-V44J...

galaxy (>=25.1.0, <=25.1.2), galaxy-ng (>=4.8.0, <=4.9.2) +6 more potentially affected by CVE-2026-62322 via social-auth-core (4.7.0)

social-auth-core PYPI version 4.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - galaxy =25.1.0, =4.8.0, =0.9.0, =1.40.0, =1.111.0, =1.2.6, =4.16.3, =5.5.5 - weblate-fedora-messaging 0.6.0 Source cves:...

edx-oauth2-wordpress-backend (>=1.0.0, <=1.0.4), richie (>=2.13.0, <=2.14.1) +2 more potentially affected by CVE-2026-62322 via social-auth-core (4.2.0)

social-auth-core PYPI version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - edx-oauth2-wordpress-backend =1.0.0, =2.13.0, =14.0.0, =4.11.0, =4.12.2 Source cves: CVE-2026-62322 Source advisory:...

richie (>=2.8.0, <=2.12.0), weblate (>=4.9.0, <=4.10.1) potentially affected by CVE-2026-62322 via social-auth-core (4.1.0)

social-auth-core PYPI version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - richie =2.8.0, =4.9.0, =4.10.1 Source cves: CVE-2026-62322 Source advisory: OSV:GHSA-526J-582W-7FM9...

Weblate 5.15.2 SSH Keyscan Argument Injection

Weblate versions prior to 5.16.0 contain an argument injection in the SSH management console. An authenticated administrator can use the supplied proof of concept to cause ssh-keyscan to read a server-local file and reflect its contents in error output. https://packetstorm.news/download/235840...

CVE-2026-86042

Impact An authenticated user who can import project backups can craft a backup containing a "weblate://" repository link to a component they cannot access. During restoration, Weblate did not enforce the component.edit permission check used by the normal UI and API. The imported component could...

perceval-opnfv (>=0.2.2rc1, <=0.2.2rc2), perceval-puppet (>=0.2.2rc1, <=0.2.2rc2) +1 more potentially affected by CVE-2026-114094 via dulwich (0.20.34)

dulwich PYPI version 0.20.34 is affected by a known vulnerability. The following packages have a transitive dependency on dulwich and may be impacted: - perceval-opnfv =0.2.2rc1, =0.2.2rc1, =0.2.2rc1, =0.2.2rc2 Source cves: CVE-2026-114094 Source advisory: OSV:GHSA-8MCX-5RQC-VHMF...

perceval-opnfv (>=0.2.2rc1, <=0.2.2rc2), perceval-puppet (>=0.2.2rc1, <=0.2.2rc2) +1 more potentially affected by CVE-2026-114095 via dulwich (0.20.34)

dulwich PYPI version 0.20.34 is affected by a known vulnerability. The following packages have a transitive dependency on dulwich and may be impacted: - perceval-opnfv =0.2.2rc1, =0.2.2rc1, =0.2.2rc1, =0.2.2rc2 Source cves: CVE-2026-114095 Source advisory: OSV:GHSA-35MR-4567-66VG...

richie (>=2.8.0, <=2.12.0), weblate (>=4.9.0, <=4.10.1) potentially affected by CVE-2026-57178 via social-auth-core (4.1.0)

social-auth-core PYPI version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - richie =2.8.0, =4.9.0, =4.10.1 Source cves: CVE-2026-57178 Source advisory: OSV:PYSEC-2026-4165...

richie (>=2.8.0, <=2.12.0), weblate (>=4.9.0, <=4.10.1) potentially affected by CVE-2026-57179 via social-auth-core (4.1.0)

social-auth-core PYPI version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - richie =2.8.0, =4.9.0, =4.10.1 Source cves: CVE-2026-57179 Source advisory: OSV:PYSEC-2026-4168...

richie (>=2.8.0, <=2.12.0), weblate (>=4.9.0, <=4.10.1) potentially affected by CVE-2026-57176 via social-auth-core (4.1.0)

social-auth-core PYPI version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - richie =2.8.0, =4.9.0, =4.10.1 Source cves: CVE-2026-57176 Source advisory: OSV:PYSEC-2026-4166...

richie (>=2.8.0, <=2.12.0), weblate (>=4.9.0, <=4.10.1) potentially affected by CVE-2026-57177 via social-auth-core (4.1.0)

social-auth-core PYPI version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - richie =2.8.0, =4.9.0, =4.10.1 Source cves: CVE-2026-57177 Source advisory: OSV:PYSEC-2026-4169...

edx-oauth2-wordpress-backend (>=1.0.0, <=1.0.4), richie (>=2.13.0, <=2.14.1) +2 more potentially affected by CVE-2026-57178 via social-auth-core (4.2.0)

social-auth-core PYPI version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - edx-oauth2-wordpress-backend =1.0.0, =2.13.0, =14.0.0, =4.11.0, =4.12.2 Source cves: CVE-2026-57178 Source advisory:...

edx-oauth2-wordpress-backend (>=1.0.0, <=1.0.4), richie (>=2.13.0, <=2.14.1) +2 more potentially affected by CVE-2026-57179 via social-auth-core (4.2.0)

social-auth-core PYPI version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - edx-oauth2-wordpress-backend =1.0.0, =2.13.0, =14.0.0, =4.11.0, =4.12.2 Source cves: CVE-2026-57179 Source advisory:...

edx-oauth2-wordpress-backend (>=1.0.0, <=1.0.4), richie (>=2.13.0, <=2.14.1) +2 more potentially affected by CVE-2026-57176 via social-auth-core (4.2.0)

social-auth-core PYPI version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - edx-oauth2-wordpress-backend =1.0.0, =2.13.0, =14.0.0, =4.11.0, =4.12.2 Source cves: CVE-2026-57176 Source advisory:...

edx-oauth2-wordpress-backend (>=1.0.0, <=1.0.4), richie (>=2.13.0, <=2.14.1) +2 more potentially affected by CVE-2026-57177 via social-auth-core (4.2.0)

social-auth-core PYPI version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - edx-oauth2-wordpress-backend =1.0.0, =2.13.0, =14.0.0, =4.11.0, =4.12.2 Source cves: CVE-2026-57177 Source advisory:...

galaxy (>=25.1.0, <=25.1.2), galaxy-ng (>=4.8.0, <=4.9.2) +6 more potentially affected by CVE-2026-57178 via social-auth-core (4.7.0)

social-auth-core PYPI version 4.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - galaxy =25.1.0, =4.8.0, =0.9.0, =1.40.0, =1.111.0, =1.2.6, =4.16.3, =5.5.5 - weblate-fedora-messaging 0.6.0 Source cves:...