https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T21:09:03.641236+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-33220 CVE-2026-33220 — Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository 2026-10-04T21:09:03.642907+00:00

Affected: WeblateOrg weblate

Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpoints, which in turn didn't perform proper access control. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can disable this feature as the CDN add-on is not enabled by default.

 https://cve.radiocsirt.org/vuln/ghsa-mqph-7h49-hqfm GHSA-mqph-7h49-hqfm — Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository 2026-10-04T21:09:03.642960+00:00

Affected: PyPI: Weblate

### Impact The translation memory API exposed unintended endpoints, which in turn didn't do proper access control.

### Patches * https://github.com/WeblateOrg/weblate/pull/18516

### Workarounds The CDN add-on is not enabled by default.

### References Thanks to @spbavarva for reporting this responsibly via GitHub.