Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| DNSSEC Zone Walk using NSEC Records#228471 | Informative | Information Disclosure | None | 2018-01-30 | – | 1 |
| CSP "script-src" includes "unsafe-inline" in weblate.org and demo.weblate.org#231062 | Informative | Misconfiguration and Insecure Design | None | 2017-05-23 | – | 1 |
| No rate limit or captcha to identify humans#257384 | Valid | Misconfiguration and Insecure Design | None | 2017-09-15 | – | 1 |
| Specify maximal length in translation#224015 | Valid | Misconfiguration and Insecure Design | None | 2017-05-17 | – | 2 |
| Incorrect HTTPS Certificate#225540 | Valid | Cryptography | None | 2017-06-16 | – | 2 |
| Directory Listing#223384 | Valid | Cryptography | None | 2017-06-16 | – | 3 |
| HttpOnly Flag not set#224006 | Valid | Misconfiguration and Insecure Design | None | 2017-05-18 | – | 3 |
| Improper validation of unicode characters#2#279945 | Informative | No weakness recorded | None | 2020-07-26 | – | 3 |
| hosted.weblate.org display of unfiltered results#1454552 | Informative | No weakness recorded | None | 2022-01-21 | – | 3 |
| Abuse of Api that causes spamming users and possible DOS due to missing rate limit on contact form#223542 | Valid | No weakness recorded | None | 2017-05-17 | – | 4 |
| No filteration of null characters in name field#242945 | Valid | Misconfiguration and Insecure Design | None | 2017-07-27 | – | 4 |
| Error Message When Changing Username#243664 | Valid | Input Validation and Logic | None | 2017-08-17 | – | 4 |
| Improper validation of unicode characters#278718 | Valid | No weakness recorded | None | 2017-11-17 | – | 4 |
| Audit log validation#296632 | Valid | Injection and Smuggling | None | 2018-08-28 | – | 4 |
| Access to completion page without performing any action#223846 | Valid | Access Control | None | 2017-05-18 | – | 5 |
| Self-XSS can be achieved in the editor link using filter bypass#229735 | Valid | Cross-site Scripting | None | 2017-06-02 | – | 5 |
| Option method enabled#230194 | Valid | Misconfiguration and Insecure Design | None | 2017-05-21 | – | 5 |
| The username of an account can be ..#243609 | Valid | Input Validation and Logic | None | 2017-07-27 | – | 5 |
| Password token validation in Weblate Bypass#243842 | Valid | Authentication | None | 2017-08-21 | – | 5 |
| Secret_key in GitHub#926093 | Informative | Information Disclosure | None | 2020-07-18 | – | 6 |
| Running 2 accounts with a single email#224072 | Valid | Input Validation and Logic | None | 2017-05-18 | – | 7 |
| Weblate |Security Misconfiguration| Method Enumeration Possible on domain#230648 | Valid | No weakness recorded | None | 2017-07-02 | – | 7 |
| Missing Restriction On String Size#257376 | Valid | Memory Corruption | None | 2017-09-16 | – | 8 |
| Missing filteration of meta characters in full name field on registration page https://demo.weblate.org/accounts/register#225901 | Valid | Misconfiguration and Insecure Design | None | 2017-05-22 | – | 9 |
| DKIM records not present, Email Hijacking is possible.....#253926 | Valid | Authentication | None | 2017-09-16 | – | 12 |
| No rate limiting for Remove Account lead to huge Mass mailingsAnalysed#1723445 | Valid | Input Validation and Logic | None | 2022-11-20 | – | 13 |
| Broken Authentication – Session Token bugAnalysed#400826 | Valid | No weakness recorded | None | 2018-09-26 | – | 19 |
| Open Github Repo Leaking WEBLATE SECRET KEYAnalysed#942146 | Valid | Cryptography | None | 2020-07-26 | – | 22 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.