Technology · PyPI
weblate (PyPI) vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 44 vulnerabilities in weblate (PyPI): 0 in the last 7 days and 9 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-77573, was published on 26 August 2026. Nothing was published in the last eight weeks.
- Last 7 days
- 0
- Last 90 days
- 9
- Critical, all time
- 2
- Exploited in the wild
- 0
About weblate (PyPI)
Weblate is a web-based translation and localization platform for managing software translations.
Latest weblate (PyPI) vulnerabilities
- CVE-2026-77573: Weblate DNS rebinding SSRF in VCS operationslowCVSS 3.5EPSS 0.2%
- CVE-2026-77507: Weblate RSS feed authorization bypassmediumCVSS 5.3EPSS 0.4%
- CVE-2026-62326: Weblate regex denial of service in source string flagsmediumCVSS 6.5EPSS 0.4%
- CVE-2026-62249: Weblate improper authorization in nested API change endpointsmediumCVSS 4.3EPSS 0.3%
- CVE-2026-61792: Weblate path traversal in App store metadata downloadhighCVSS 7.7EPSS 0.6%
- CVE-2026-61790: Weblate team-enforced 2FA bypass for global permissionsmediumCVSS 4.4EPSS 0.4%
- CVE-2026-55228: Weblate IDOR in GroupViewSet authorization bypasshighCVSS 8.1EPSS 0.4%
- CVE-2026-55227: Weblate observable object existence disclosure via HTTP status codesmediumCVSS 4.3EPSS 0.3%
- CVE-2026-77508: Weblate unverified email change in REST APIlowCVSS 3.5EPSS 0.3%
- CVE-2026-21889: PYSEC-2026-2037 - Weblate leaks information via screenshotsmediumCVSS 4EPSS 0.4%
- CVE-2025-68279: PYSEC-2026-2040 - Weblate has an arbitrary file read via symbolic linkslowCVSS 3.1EPSS 0.4%
- CVE-2025-58352: PYSEC-2026-2036 - Weblate has a long session expiry when verifying second factormediumCVSS 4EPSS 0.3%
- CVE-2025-49134: PYSEC-2026-2038 - Weblate exposes personal IP address via e-maillowCVSS 3.1EPSS 0.3%
- CVE-2025-47951: PYSEC-2026-2039 - Weblate lacks rate limiting when verifying second factorlowCVSS 3.1EPSS 0.3%
- CVE-2024-39303: PYSEC-2026-2041 - Weblate vulnerable to improper sanitization of project backupslowCVSS 3.1EPSS 0.3%
- CVE-2026-50127: Weblate SSRF via private range restriction bypass in VCS_RESTRICT_PRIVATEmediumCVSS 5.9EPSS 0.5%
- CVE-2026-45106: Weblate stored XSS in live search previewmediumCVSS 4.6EPSS 0.3%
- CVE-2026-44264: Weblate XSS in Markdown renderer via image attributesmediumCVSS 4.3EPSS 0.4%
- CVE-2026-44263: Weblate translation enumeration via API information disclosuremediumCVSS 4.3EPSS 0.4%
- CVE-2026-41654: Weblate SSRF via crafted project backup importhighCVSS 8.1EPSS 0.5%
- CVE-2026-41519: Weblate insufficient session expiration for API tokens on password changemediumCVSS 4.2EPSS 0.4%
- CVE-2026-40256: Weblate path traversal via repository boundary check bypassmediumCVSS 5EPSS 0.3%
- CVE-2026-39845: Weblate SSRF in webhook add-on via fetch_urlmediumCVSS 4.1EPSS 0.3%
- CVE-2026-34393: Weblate privilege escalation in user API endpointhighCVSS 8.8EPSS 0.4%
- CVE-2026-34244: Weblate SSRF in Project-Level Machinery ConfigurationmediumCVSS 5EPSS 0.3%
Most severe weblate (PyPI) vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2025-64725: PYSEC-2026-2042 - Weblate has improper validation upon invitation acceptancecriticalCVSS 9.8EPSS 0.4%
- CVE-2025-68398: PYSEC-2026-571 - Weblate is vulnerable to RCE through Git config file overwritecriticalCVSS 9.1EPSS 0.8%
- CVE-2026-34393: Weblate privilege escalation in user API endpointhighCVSS 8.8EPSS 0.4%
- CVE-2026-41654: Weblate SSRF via crafted project backup importhighCVSS 8.1EPSS 0.5%
- CVE-2026-55228: Weblate IDOR in GroupViewSet authorization bypasshighCVSS 8.1EPSS 0.4%
- CVE-2026-33435: Weblate remote code execution in backup restorationhighCVSS 8EPSS 0.7%
- CVE-2026-61792: Weblate path traversal in App store metadata downloadhighCVSS 7.7EPSS 0.6%
- CVE-2026-34242: Weblate arbitrary file read via symlink in ZIP downloadhighCVSS 7.7EPSS 0.5%
- CVE-2026-33220: Weblate path traversal in JavaScript localization CDN add-onmediumCVSS 6.8EPSS 0.3%
- CVE-2026-62326: Weblate regex denial of service in source string flagsmediumCVSS 6.5EPSS 0.4%
Vulnerabilities per week
Nothing was published in the last eight weeks. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 9 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many weblate (PyPI) vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/weblate)<a href="https://junglewise.ai/threats/technologies/weblate"><img src="https://junglewise.ai/threats/technologies/weblate/badge.svg" alt="weblate (PyPI) vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/weblate.json, and this page as text at https://junglewise.ai/threats/technologies/weblate.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "weblate (PyPI) vulnerabilities", https://junglewise.ai/threats/technologies/weblate, 13 November 2026.