These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-62364 is a vulnerability in the Weblate command-line client (wlc) that can lead to the disclosure of an unscoped API token when used in an untrusted repository or directory. The issue arises from the client's configuration discovery feature, which can select an API URL from certain configuration files without requiring a matching URL for the provided API token. This can result in the token being [truncated]
CVE-2026-77573 is a server-side request forgery (SSRF) vulnerability in Weblate, a web-based continuous localization platform. An attacker with permission to manage component repository URLs can cause Weblate to reach internal VCS-compatible services, potentially exposing private repository contents. This issue is fixed in version 2026.8. Weblate validates the hostname's first DNS resolution, but external [truncated]
CVE-2026-77507 debrief based on the supplied source corpus. The CVE record was published on 2026-08-26T21:16:41.573Z and has not been modified since then. Weblate versions prior to 2026.8 have a vulnerability in object-scoped RSS feeds, which do not apply proper permission checks. This allows unauthorized users to read change-history metadata from private projects and restricted components. The exposed in [truncated]
A vulnerability in Weblate, a web-based continuous localization platform, allows a user with the built-in 'Edit source' role to store a malicious regular expression in a source string's flags. This can be used to stall requests and deny service. The issue is fixed in version 2026.7. Affected Weblate instances, particularly those with untrusted users, are at risk of denial-of-service attacks. Defenders sho [truncated]
CVE-2026-62249 is a vulnerability in Weblate, a web-based continuous localization platform. An authenticated user with access to a project can retrieve the change history of restricted components in that project through nested API change endpoints, even without permission to view those components directly. The issue allows unauthorized access to sensitive component change history, potentially exposing res [truncated]
A project administrator in Weblate can read files outside their repository through the App store metadata download feature due to inadequate path confinement. This issue, fixed in version 2026.7, allows disclosure of file contents on the Weblate host outside the project's repository. The vulnerability is a result of incomplete path confinement, enabling an attacker-influenced path resolution. This issue i [truncated]
CVE-2026-61790 is a medium-severity vulnerability in Weblate, a web-based continuous localization platform. The issue allows users to receive site-wide global permissions without configuring two-factor authentication (2FA), even if their team enforces 2FA for other permission levels. This discrepancy could lead to unintended access to sensitive areas, such as the site management interface. The vulnerabili [truncated]
CVE-2026-55228 is a high-severity vulnerability in Weblate, a web-based continuous localization platform. In versions prior to 2026.7, the REST API did not properly enforce team scopes, allowing users to submit invalid team configurations and potentially expose private projects, permitting unauthorized translation, repository, and project-management operations.
CVE-2026-55227 debrief based on the supplied source corpus. The CVE record was published on 2026-08-26T21:16:38.587Z. Weblate versions prior to 2026.7 have a vulnerability allowing unauthorized users to infer the existence of private project objects. The issue has been fixed in version 2026.7. Defenders should assess exposure and update to the latest version. This vulnerability has a CVSS score of 4.3 and [truncated]
CVE-2026-77508 is a low-severity vulnerability in Weblate, a web-based localization tool. An authenticated user can change their account's primary email address without verifying the new address, potentially allowing team invitations to be accepted by unintended recipients. This issue was fixed in version 2026.8. Weblate administrators should assess exposure and prioritize verification of their deployment [truncated]
CVE-2026-50127 is a MEDIUM severity vulnerability in Weblate, a web-based localization tool. Versions from 5.15 to before 2026.6 are affected due to improper IP range restrictions. The `VCS_RESTRICT_PRIVATE` setting did not correctly account for certain IPv6 transitional ranges, multicast addresses, and semi-private IPv4 ranges. This oversight allowed some addresses to bypass private range restrictions. T [truncated]
CVE-2026-45106 is a MEDIUM severity vulnerability in Weblate, a web-based localization tool. Prior to version 2026.5, Weblate's live search preview renders unit source and context as HTML without escaping. This allows any contributor whose content reaches those fields to store HTML and CSS that runs inside the authenticated editor of every user who runs a matching search. The vulnerability has been patche [truncated]
CVE-2026-40256 is a vulnerability in Weblate, a web-based localization tool, affecting versions prior to 5.17. The issue arises from repository-boundary validation that relies on string prefix checks on resolved absolute paths, which can be bypassed when an external path shares the same string prefix as the repository path. This vulnerability has been fixed in version 5.17.
CVE-2026-39845 is a vulnerability in Weblate, a web-based localization tool, affecting versions prior to 5.17. The webhook add-on did not utilize existing SSRF protections, allowing for potential Server-Side Request Forgery attacks. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can disable the webhook add-on as a workaround.
CVE-2026-34393 is a high-severity vulnerability in Weblate, a web-based localization tool. The user patching API endpoint in versions prior to 5.17 did not properly limit the scope of edits, allowing for potential unauthorized modifications. This issue has been fixed in version 5.17. Defenders should assess exposure and prioritize upgrading to version 5.17 or later. The vulnerability allows for potential [truncated]
CVE-2026-34244 is a Server-Side Request Forgery (SSRF) vulnerability with partial response read in Weblate, a web-based localization tool. In versions prior to 5.17, a user with project.edit permission can configure machine translation service URLs pointing to arbitrary internal network addresses. During configuration validation, Weblate makes an HTTP request to the attacker-controlled URL and reflects up [truncated]
CVE-2026-34242 is a high-severity vulnerability in Weblate, a web-based localization tool. In versions prior to 5.17, the ZIP download feature did not verify downloaded files, potentially following symlinks outside the repository. This issue has been fixed in version 5.17. Defenders responsible for Weblate installations should assess exposure and prioritize upgrading to version 5.17 or later to prevent po [truncated]
CVE-2026-33440 is a medium-severity vulnerability in Weblate, a web-based localization tool. In versions prior to 5.17, the ALLOWED_ASSET_DOMAINS setting did not restrict possible redirects, potentially allowing attackers to access unauthorized resources. This issue was fixed in version 5.17. Weblate administrators and users should assess exposure and prioritize updating to version 5.17 or later to mitiga [truncated]
CVE-2026-33435 is a high-severity vulnerability in Weblate, a web-based localization tool. In versions prior to 5.17, the project backup feature did not filter Git and Mercurial configuration files, potentially leading to remote code execution under certain circumstances. The issue has been fixed in version 5.17. If immediate updates are not possible, limiting access to project backups can mitigate the vulnerability.
CVE-2026-33220 is a vulnerability in Weblate, a web-based localization tool, affecting versions prior to 5.17. The translation memory API exposed unintended endpoints without proper access control. This issue was fixed in version 5.17. If immediate updates are not possible, developers can disable this feature as the CDN add-on is not enabled by default.
CVE-2026-33214 is a vulnerability in Weblate, a web-based localization tool, prior to version 5.17. The translation memory API exposed unintended endpoints without proper access control. Users can update to version 5.17 or block access to /api/memory/ in the HTTP server as a workaround. This issue allows unauthorized access to translation memory features, potentially leading to data exposure. Defenders sh [truncated]
CVE-2026-33212 is a low-severity vulnerability in Weblate, a web-based localization tool. The issue, fixed in version 5.17, allows unauthorized access to logs of in-progress operations for pending tasks via the tasks API. Attackers must brute-force the random UUID of the task, making exploitation unlikely with default API rate limits. Defenders should assess exposure and verify version 5.17 or later is de [truncated]