Weblate CVE-2026-24126

Improper input validation in Weblate versions prior to 5.15.1 lets a user who can submit translation files or restore pr

Privilege escalation in Weblate versions prior to 5.17 allows an authenticated low-privileged user to modify sensitive f

The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when u

Argument injection in Weblate's Mercurial backend lets an authenticated user with project-scoped component.edit permissi

Weblate's REST API failed to enforce permission scope on team (group) assignments in all versions prior to 2026.7, allow

Remote code execution in Weblate's project backup restoration affects versions prior to 5.17, exploitable by authenticat

The wlc Weblate command-line client prior to version 1.17.2 is vulnerable to arbitrary file write attacks through path t

Arbitrary file read via symlink traversal in Weblate's App store metadata ZIP download affects all versions prior to 202

Arbitrary file read vulnerability in Weblate versions prior to 5.17 allows authenticated attackers to read sensitive fil

Weblate versions prior to 5.15.2 expose screenshot images through the web server without authentication controls, enabli

Path traversal in Weblate allows authenticated users to read arbitrary files outside the repository via the translation

Unbounded regular expression evaluation in Weblate prior to 2026.7 allows any authenticated user holding the built-in 'E