W
Vendor security profile
WeblateOrg
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs11
Critical0
CISA KEV0
Public exploit0
Patch rate%0
Avg. CVSS5.3
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
9
2
0
CVE KEV
CVE severity distribution
11toplam CVE
High3 (27%)
Medium5 (45%)
Low3 (27%)
Patch and exploitation view
%0
Verified patch
%0
CISA KEV
%0
Public exploit
0Patch available
0Partial
0Workaround
0Vendor: no patch
11Unknown
Latest vulnerabilities
8.5
CVE-2026-86035
Weblate: Mercurial argument injection via repository filenames allows authenticated command execution
W
Patch status unknownEPSS %0
2.3
CVE-2026-62364
wlc may disclose API tokens to project-configured URLs
W
Patch status unknownEPSS %0
3.5
CVE-2026-77573
Weblate: DNS rebinding in VCS operations allows server-side request forgery
W
Patch status unknownEPSS %0
5.3
CVE-2026-77507
Weblate: Object-scoped RSS feeds disclose private change history to unauthorized users
W
Patch status unknownEPSS %0
6.5
CVE-2026-62326
Weblate Has Uncontrolled Resource Consumption via
W
Patch status unknownEPSS %0
4.3
CVE-2026-62249
Weblate: Restricted-component change history leaked to non-member project users through the nested `GET /api/projects/{slug}/changes/` endpoint
W
Patch status unknownEPSS %0
7.7
CVE-2026-61792
Weblate path traversal allows a project administrator to read arbitrary files via App store metadata download (Incomplete Fix of CVE-2026-34242)
W
Patch status unknownEPSS %1
4.4
CVE-2026-61790
Weblate: Team-enforced 2FA is bypassed for global permissions
W
Patch status unknownEPSS %0
8.1
CVE-2026-55228
Weblate:: WebIDOR in GroupViewSet allows authenticated project manager to gain unauthorized read access to any private project
W
Patch status unknownEPSS %0
4.3
CVE-2026-55227
Observable object existence disclosure in private Weblate projects via globally scoped object lookups
W
Patch status unknownEPSS %0