Vendor
Weblate vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 29 vulnerabilities in Weblate: 0 in the last 7 days and 9 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-86035, was published on 29 September 2026. Nothing in the last four weeks, down from 1 vulnerability in the four before. 1 technology has a page of its own.
- Last 7 days
- 0
- Last 90 days
- 9
- Critical, all time
- 2
- Exploited in the wild
- 0
About Weblate
Web-based localization and translation management platform.
Weblate technologies
- Weblate17
Latest Weblate vulnerabilities
- CVE-2026-86035: Weblate argument injection in Mercurial backendhighCVSS 8.5
- CVE-2026-77573: Weblate DNS rebinding SSRF in VCS operationslowCVSS 3.5EPSS 0.2%
- CVE-2026-77507: Weblate RSS feed authorization bypassmediumCVSS 5.3EPSS 0.4%
- CVE-2026-62326: Weblate regex denial of service in source string flagsmediumCVSS 6.5EPSS 0.4%
- CVE-2026-62249: Weblate improper authorization in nested API change endpointsmediumCVSS 4.3EPSS 0.3%
- CVE-2026-61792: Weblate path traversal in App store metadata downloadhighCVSS 7.7EPSS 0.6%
- CVE-2026-61790: Weblate team-enforced 2FA bypass for global permissionsmediumCVSS 4.4EPSS 0.4%
- CVE-2026-55227: Weblate observable object existence disclosure via HTTP status codesmediumCVSS 4.3EPSS 0.3%
- CVE-2026-77508: Weblate unverified email change in REST APIlowCVSS 3.5EPSS 0.3%
- CVE-2026-21889: PYSEC-2026-2037 - Weblate leaks information via screenshotsmediumCVSS 4EPSS 0.4%
- CVE-2026-22250: PYSEC-2026-2051 - Weblate command-line client susceptible to SSL verification skiplowCVSS 3.1EPSS 0.2%
- CVE-2025-58352: PYSEC-2026-2036 - Weblate has a long session expiry when verifying second factormediumCVSS 4EPSS 0.3%
- CVE-2026-40256: Weblate path traversal via repository boundary check bypassmediumCVSS 5EPSS 0.3%
- CVE-2026-39845: Weblate SSRF in webhook add-on via fetch_urlmediumCVSS 4.1EPSS 0.3%
- CVE-2026-34393: Weblate privilege escalation in user API endpointhighCVSS 8.8EPSS 0.4%
- CVE-2026-34244: Weblate SSRF in Project-Level Machinery ConfigurationmediumCVSS 5EPSS 0.3%
- CVE-2026-34242: Weblate arbitrary file read via symlink in ZIP downloadhighCVSS 7.7EPSS 0.5%
- CVE-2026-33440: Weblate SSRF via redirect bypass in screenshot URL uploadsmediumCVSS 5EPSS 0.2%
- CVE-2026-33435: Weblate remote code execution in backup restorationhighCVSS 8EPSS 0.7%
- CVE-2026-33220: Weblate path traversal in JavaScript localization CDN add-onmediumCVSS 6.8EPSS 0.3%
- CVE-2026-33214: Weblate improper access control in translation memory APImediumCVSS 4.3EPSS 0.2%
- CVE-2026-33212: Weblate improper access control for pending tasks in APIlowCVSS 3.1EPSS 0.2%
- CVE-2026-24126: Weblate argument injection in SSH management consolelowCVSS 3.1EPSS 0.5%
- CVE-2025-68398: PYSEC-2026-571 - Weblate is vulnerable to RCE through Git config file overwritecriticalCVSS 9.1EPSS 0.8%
- CVE-2025-67715: Weblate IDOR user and project enumeration in REST APImediumCVSS 4.3EPSS 0.3%
Most severe Weblate vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2025-64725: PYSEC-2026-2042 - Weblate has improper validation upon invitation acceptancecriticalCVSS 9.8EPSS 0.4%
- CVE-2025-68398: PYSEC-2026-571 - Weblate is vulnerable to RCE through Git config file overwritecriticalCVSS 9.1EPSS 0.8%
- CVE-2026-34393: Weblate privilege escalation in user API endpointhighCVSS 8.8EPSS 0.4%
- CVE-2026-86035: Weblate argument injection in Mercurial backendhighCVSS 8.5
- CVE-2026-33435: Weblate remote code execution in backup restorationhighCVSS 8EPSS 0.7%
- CVE-2026-61792: Weblate path traversal in App store metadata downloadhighCVSS 7.7EPSS 0.6%
- CVE-2026-34242: Weblate arbitrary file read via symlink in ZIP downloadhighCVSS 7.7EPSS 0.5%
- CVE-2026-33220: Weblate path traversal in JavaScript localization CDN add-onmediumCVSS 6.8EPSS 0.3%
- CVE-2026-62326: Weblate regex denial of service in source string flagsmediumCVSS 6.5EPSS 0.4%
- CVE-2026-77507: Weblate RSS feed authorization bypassmediumCVSS 5.3EPSS 0.4%
Vulnerabilities per week
Nothing in the last four weeks, down from 1 vulnerability in the four before. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 8 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 1 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Weblate vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/weblate)<a href="https://junglewise.ai/threats/vendors/weblate"><img src="https://junglewise.ai/threats/vendors/weblate/badge.svg" alt="Weblate vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/weblate.json, and this page as text at https://junglewise.ai/threats/vendors/weblate.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Weblate vulnerabilities", https://junglewise.ai/threats/vendors/weblate, 9 November 2026.