**Unauthenticated IDOR allows modification of payment customer billing information** Analysed #3869124 Valid Insecure Direct Object Reference High 2026-08-30 – 72 exposure of personal IP address via email. Analysed #3179850 Valid Information Disclosure – 2025-07-16 – 61 SSRF via URL Parser Differential in `normalize_request_url` (wlc) #3887969 Valid Server-Side Request Forgery High 2026-09-02 – 43 Reset password cookie leads to account takeover #1004536 Valid Input Validation and Logic Medium 2020-10-12 – 41 Incomplete fix for CVE-2022-23915: Mercurial argument injection in HgRepository.get_file() leads to command execution #3874004 Valid Command and Code Injection High 2026-09-15 – 34 Argument Injection in /manage/ssh/ via host parameter leads to sensitive file disclosure on Weblate #3518571 Valid No weakness recorded – 2026-04-26 – 34 Unauthenticated ?q= search query causes exponential pyparsing backtracking under a process-global lock in Weblate #3898281 Valid Denial of Service High 2026-09-04 – 33 CSRF with logout action #1971589 Valid Cross-Site Request Forgery – 2023-06-16 – 29 no captcha for register user and weak question attacker can spam email #236398 Valid Misconfiguration and Insecure Design – 2019-10-26 – 29 API token sent to URL dictated by an untrusted project .weblate file #3825141 Valid Information Disclosure Medium 2026-09-04 – 27 Memory exhaustion (DoS) via unbounded file read in `EncodingDiscovery.detect_encoding()` #4028616 Valid Denial of Service Medium 2026-10-16 – 24 Open Github Repo Leaking WEBLATE SECRET KEY #942146 Valid Cryptography None 2020-07-26 – 22 Incomplete VCS metadata exclusion: `.svn` / `.bzr` bypass CVE-2026-61792 due to missing `VCS_METADATA_DIRS` entries. #4037976 Valid File and Path Handling Medium 2026-10-30 – 21 Race Condition allows to get more free trials and get more than 100 languages and strings for free #1087188 Valid Input Validation and Logic Low 2021-02-25 – 20 HTML injection and information disclosure in support panel #634312 Valid Information Disclosure Medium 2019-07-09 – 20 Broken Authentication – Session Token bug #400826 Valid No weakness recorded None 2018-09-26 – 19 Uploaded XLF files result in External Entity Execution #232614 Valid Injection and Smuggling High 2017-06-02 – 18 Rate Limit Bypass on login Page #224460 Valid Authentication Medium 2017-05-17 – 18 Uncaught RecursionError crash in translation-finder (deep directory tree DoS) #4022462 Valid Denial of Service Low 2026-10-14 – 16 Insecure Account Removal #2 #229532 Valid Misconfiguration and Insecure Design Low 2018-08-28 – 16 wlc: Project-wide download fails part-way and leaves stale archives on disk; filesystem errors surface as raw Python tracebacks. #4040149 Valid Information Disclosure Low 2026-10-30 – 14 CPU-based Denial of Service in translation-finder via O(N²) per-result wildcard mask matching #4088592 Valid Denial of Service Medium 2026-11-05 – 13 No rate limiting for Remove Account lead to huge Mass mailings #1723445 Valid Input Validation and Logic None 2022-11-20 – 13 DKIM records not present, Email Hijacking is possible..... #253926 Valid Authentication None 2017-09-16 – 12 Password Restriction #229920 Valid Misconfiguration and Insecure Design Low 2017-08-19 – 12 Translation discovery crashes on crafted filenames (regex substitution injection) #4044441 Valid Memory Corruption Low 2026-10-30 – 11 Stored XSS via Create Project (Add new translation project) #610219 Valid Cross-site Scripting Medium 2019-07-09 – 11 No Rate On Add Suggest #481654 Valid Race Conditions Low 2019-01-22 – 11 flood of comment no rate limit on commnets >> by using different user agent #404035 Valid Misconfiguration and Insecure Design Low 2018-09-28 – 11 no notification send to victim if attacker hacks/accesses his victims WebLate account. #282772 Valid Input Validation and Logic Low 2018-09-26 – 11 Login CSRF : Login Authentication Flaw #229528 Valid Cross-Site Request Forgery Medium 2017-06-02 – 11 Account Takeover using Third party Auth CSRF #225653 Valid Cross-Site Request Forgery High 2017-05-17 – 11 Logging in without knowing credentials after logged out action #1971610 Valid No weakness recorded – 2023-06-16 – 10 Rate Limit Issue on hosted.weblate.org #229825 Valid Authentication Low 2017-07-02 – 10 Weak password policy #224572 Valid No weakness recorded Low 2017-08-18 – 10 Weak e-mail change functionality could lead to account takeover #223461 Valid Misconfiguration and Insecure Design Low 2017-05-17 – 10 No rate Limit on Add new Translation Project #1238749 Valid Authentication – 2021-06-21 – 9 Missing filteration of meta characters in full name field on registration page https://demo.weblate.org/accounts/register #225901 Valid Misconfiguration and Insecure Design None 2017-05-22 – 9 Insecure Account Removal #223355 Valid Misconfiguration and Insecure Design Low 2017-05-17 – 9 Activation tokens are not expiring #223339 Valid Cross-Site Request Forgery Medium 2017-05-17 – 9 Testing flow includes a DeepSource secret #1927499 Valid Authentication Low 2023-04-11 – 8 Missing Restriction On String Size #257376 Valid Memory Corruption None 2017-09-16 – 8 Reset password more than once with a reset link #2 #245450 Valid Input Validation and Logic – 2017-10-07 – 8 Running 2 accounts with a single email #3 #245304 Valid Input Validation and Logic – 2018-08-27 – 8 Reset password more than once with a reset link #243594 Valid Input Validation and Logic – 2017-08-21 – 8 No Rate Limiting at /contact #229511 Valid Memory Corruption Low 2017-06-02 – 8 No Password Length Restriction leads to Denial of Service #223854 Valid Denial of Service Low 2017-05-17 – 8 No BruteForce Protection #223337 Valid Authentication Medium 2017-05-17 – 8 Registration captcha bypass #223324 Valid Misconfiguration and Insecure Design Medium 2017-05-17 – 8 Stored XSS @ /engage/<project_slug> #472391 Valid Cross-site Scripting Medium 2019-07-02 – 7