https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T21:08:41.477772+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-34393 CVE-2026-34393 — Weblate: Privilege escalation in the user API endpoint 2026-10-04T21:08:41.508738+00:00

Affected: WeblateOrg weblate

Weblate is a web based localization tool. In versions prior to 5.17, the user patching API endpoint didn't properly limit the scope of edits. This issue has been fixed in version 5.17.

 https://cve.radiocsirt.org/vuln/ghsa-3382-gw9x-477v GHSA-3382-gw9x-477v — Weblate: Privilege escalation in the user API endpoint 2026-10-04T21:08:41.508793+00:00

Affected: PyPI: Weblate

### Impact

The user patching API endpoint didn't properly limit the scope of edits.

### Patches * https://github.com/WeblateOrg/weblate/pull/18687

### References Thanks to @tikket1 and @DavidCarliez for reporting this via GitHub. We received two individual reports for this.