https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T06:29:13.649125+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-268864 EUVD-2026-268864 2026-10-09T06:29:13.652731+00:00 EUVD-2026-268864 https://cve.radiocsirt.org/vuln/fkie_cve-2026-24126 fkie_cve-2026-24126 2026-10-09T06:29:13.652774+00:00

Weblate is a web based localization tool. Prior to 5.16.0, the SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument injection to `ssh-add`. Version 5.16.0 fixes the issue. As a workaround, properly limit access to the management console.

 https://cve.radiocsirt.org/vuln/ghsa-33fm-6gp7-4p47 GHSA-33fm-6gp7-4p47 — Weblate has an argument injection in management console 2026-10-09T06:29:13.652820+00:00

Affected: PyPI: Weblate

### Impact The SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument injection to `ssh-add`.

### Patches * https://github.com/WeblateOrg/weblate/pull/17722

### Workarounds Properly limit access to the management console.

### References This issue was reported to us by [alexb_616](https://hackerone.com/alexb_616) via HackerOne.

 https://cve.radiocsirt.org/vuln/pysec-2026-2309 PYSEC-2026-2309 2026-10-09T06:29:13.652862+00:00

Affected: PyPI: weblate

Weblate is a web based localization tool. Prior to 5.16.0, the SSH management console did not validate the passed input while adding the SSH host key, which could lead to an argument injection to `ssh-add`. Version 5.16.0 fixes the issue. As a workaround, properly limit access to the management console.