https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T18:13:35.304898+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2025-49134 CVE-2025-49134 — Weblate exposes personal IP address via e-mail 2026-10-06T18:13:35.306849+00:00

Affected: WeblateOrg weblate

Weblate is a web based localization tool. Prior to version 5.12, the audit log notifications included the full IP address of the acting user. This could be obtained by third-party servers such as SMTP relays, or spam filters. This issue has been patched in version 5.12.

 https://cve.radiocsirt.org/vuln/ghsa-4qqf-9m5c-w2c5 GHSA-4qqf-9m5c-w2c5 — Weblate exposes personal IP address via e-mail 2026-10-06T18:13:35.306928+00:00

Affected: PyPI: weblate

### Impact

The audit log notifications included the full IP address of the acting user. This could be obtained by third-party servers such as SMTP relays, or spam filters.

### Patches

This issue has been addressed in Weblate 5.12 via https://github.com/WeblateOrg/weblate/pull/15102.

### References

Thanks to [micael1](https://hackerone.com/micael1) for reporting this [issue at HackerOne](https://hackerone.com/reports/3179850).