https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-15T23:18:55.431925+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-265735 EUVD-2026-265735 2026-10-15T23:18:55.435238+00:00 EUVD-2026-265735 https://cve.radiocsirt.org/vuln/fkie_cve-2026-21889 fkie_cve-2026-21889 2026-10-15T23:18:55.435269+00:00

Weblate is a web based localization tool. Prior to 5.15.2, the screenshot images were served directly by the HTTP server without proper access control. This could allow an unauthenticated user to access screenshots after guessing their filename. This vulnerability is fixed in 5.15.2.

 https://cve.radiocsirt.org/vuln/ghsa-3g2f-4rjg-9385 GHSA-3g2f-4rjg-9385 — Weblate leaks information via screenshots 2026-10-15T23:18:55.435299+00:00

Affected: PyPI: weblate

### Impact The screenshot images were served directly by the HTTP server without proper access control. This could allow an unauthenticated user to access screenshots after guessing their filename.

### Patches * https://github.com/WeblateOrg/weblate/pull/17516

### References

Thanks to Lukas May and Michael Leu for reporting this.

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10240-1 openSUSE-SU-2026:10240-1 — weblate-5.16-1.1 on GA media 2026-10-15T23:18:55.435326+00:00

weblate-5.16-1.1 on GA media

 https://cve.radiocsirt.org/vuln/pysec-2026-2037 PYSEC-2026-2037 — Weblate leaks information via screenshots 2026-10-15T23:18:55.435344+00:00

Affected: PyPI: weblate

### Impact The screenshot images were served directly by the HTTP server without proper access control. This could allow an unauthenticated user to access screenshots after guessing their filename.

### Patches * https://github.com/WeblateOrg/weblate/pull/17516

### References

Thanks to Lukas May and Michael Leu for reporting this.