Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Reset password cookie leads to account takeoverAnalysed#1004536 | Valid | Input Validation and Logic | Medium | 2020-10-12 | – | 41 |
| API token sent to URL dictated by an untrusted project .weblate fileAnalysed#3825141 | Valid | Information Disclosure | Medium | 2026-09-04 | – | 27 |
| Memory exhaustion (DoS) via unbounded file read in `EncodingDiscovery.detect_encoding()`Analysed#4028616 | Valid | Denial of Service | Medium | 2026-10-16 | – | 24 |
| Incomplete VCS metadata exclusion: `.svn` / `.bzr` bypass CVE-2026-61792 due to missing `VCS_METADATA_DIRS` entries.Analysed#4037976 | Valid | File and Path Handling | Medium | 2026-10-30 | – | 21 |
| HTML injection and information disclosure in support panelAnalysed#634312 | Valid | Information Disclosure | Medium | 2019-07-09 | – | 20 |
| Rate Limit Bypass on login PageAnalysed#224460 | Valid | Authentication | Medium | 2017-05-17 | – | 18 |
| CPU-based Denial of Service in translation-finder via O(N²) per-result wildcard mask matchingAnalysed#4088592 | Valid | Denial of Service | Medium | 2026-11-05 | – | 13 |
| Stored XSS via Create Project (Add new translation project)#610219 | Valid | Cross-site Scripting | Medium | 2019-07-09 | – | 11 |
| Login CSRF : Login Authentication Flaw#229528 | Valid | Cross-Site Request Forgery | Medium | 2017-06-02 | – | 11 |
| Activation tokens are not expiring#223339 | Valid | Cross-Site Request Forgery | Medium | 2017-05-17 | – | 9 |
| No BruteForce Protection#223337 | Valid | Authentication | Medium | 2017-05-17 | – | 8 |
| Registration captcha bypass#223324 | Valid | Misconfiguration and Insecure Design | Medium | 2017-05-17 | – | 8 |
| Stored XSS @ /engage/<project_slug>#472391 | Valid | Cross-site Scripting | Medium | 2019-07-02 | – | 7 |
| CSRF to Connect third party Account#225100 | Valid | Cross-Site Request Forgery | Medium | 2017-05-02 | – | 7 |
| CSV export filter bypass leads to formula injection.#223999 | Valid | Command and Code Injection | Medium | 2017-05-17 | – | 6 |
| No Rate Limitting at Change Password#223694 | Valid | No weakness recorded | Medium | 2017-05-17 | – | 6 |
| Open redirect while disconnecting authenticated account#224317 | Valid | Open Redirect | Medium | 2017-06-08 | – | 5 |
| CSRF : Lock and Unlock Translation#223345 | Valid | Cross-Site Request Forgery | Medium | 2017-05-17 | – | 5 |
| Open Redirect via "next" parameter in third-party authentication#223326 | Valid | Open Redirect | Medium | 2017-05-17 | – | 5 |
| CSRF bypass ( Delate Source Translation From dictionaries ) in demo.weblate.org#230863 | Valid | Cross-Site Request Forgery | Medium | 2017-06-02 | – | 4 |
| Bypassing captcha in registration on Hosted site#224342 | Informative | Denial of Service | Medium | 2017-07-03 | – | 4 |
| Open redirect in Signing in via Social Sites#223718 | Duplicate | Open Redirect | Medium | 2017-05-17 | – | 3 |
| CSRF - Changing the full name / adding a secondary email identity of an account via a GET request#223367 | Valid | Cross-Site Request Forgery | Medium | 2017-06-02 | – | 3 |
| full path disclosure at hosted.weblate.org/admin/accounts/profile/#225495 | Valid | File and Path Handling | Medium | 2017-05-17 | – | 2 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.