Weblate · disclosed reports
No weakness filed
40 disclosed reports · $0 paid · 35 valid · 3 informative · 2 duplicate
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open Weblate on HackerOne- reports
- 40
- valid
- 35
- paid a bounty
- 0
Every one of the 40 is a mark on the map. Named now: 1 to 26, most upvoted first.
- Argument Injection in /manage/ssh/ via host parameter leads to sensitive file disclosure on Weblate
- Broken Authentication – Session Token bug
- Logging in without knowing credentials after logged out action
- Weak password policy
- Invalidate session after password reset - hosted website
- Password token validation in Weblate Bypass #2
- Weblate |Security Misconfiguration| Method Enumeration Possible on domain
- Application allowing old password to be set as new password | hosted.weblate.org
- Improper validation of unicode characters #3
- Full Name Overwrite on Third party login
- Old password can be new password
- No Rate Limitting at Change Password
- [hosted.weblate.org]Account Takeover
- You can simply just use passwords that simply are as 123456
- Tab nabbing via window.opener
- No Rate Limitation on Regenerate Api Key
- Improper validation of unicode characters still not fixed #2
- Improper validation of unicode characters still not fixed
- Improper Cookie expiration | Cookies Expiration Set to Future
- Missing restriction on string size
- session id missing secure flag - Hosted Website
- Clickjacking docs.weblate.org
- Improper validation of unicode characters
- Account Restore / Reactivating an old email via old reset link
- Previous password could set as new password
- Weblate- Banner Grabbing-Ngnix Server version
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data. Use this via MCP