https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T23:51:53.309589+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-291498 EUVD-2026-291498 2026-10-05T23:51:53.403588+00:00 EUVD-2026-291498 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33440 fkie_cve-2026-33440 2026-10-05T23:51:53.403654+00:00

Weblate is a web based localization tool. In versions prior to 5.17, the ALLOWED_ASSET_DOMAINS setting applied only to the first issued requests and didn't restrict possible redirects. This issue has been fixed in version 5.17.

 https://cve.radiocsirt.org/vuln/ghsa-5fhx-9jwj-867m GHSA-5fhx-9jwj-867m — Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads 2026-10-05T23:51:53.403709+00:00

Affected: PyPI: weblate

### Impact The ALLOWED_ASSET_DOMAINS setting applied only to the first issued requests and didn't restrict possible redirects.

### Patches * https://github.com/WeblateOrg/weblate/pull/18550

### References This issue was reported by @spbavarva via GitHub.

 https://cve.radiocsirt.org/vuln/pysec-2026-2312 PYSEC-2026-2312 2026-10-05T23:51:53.403753+00:00

Affected: PyPI: weblate

Weblate is a web based localization tool. In versions prior to 5.17, the ALLOWED_ASSET_DOMAINS setting applied only to the first issued requests and didn't restrict possible redirects. This issue has been fixed in version 5.17.