https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T10:00:58.338974+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-45106 CVE-2026-45106 — Weblate: Stored HTML injection in editor search preview 2026-10-03T10:00:58.369188+00:00

Affected: WeblateOrg weblate

Weblate is a web based localization tool. Prior to version 2026.5, Weblate's live search preview renders unit source and context as HTML without escaping. Any contributor whose content reaches those fields stores HTML and CSS that runs inside the authenticated editor of every user who runs a matching search. This issue has been patched in version 2026.5.

 https://cve.radiocsirt.org/vuln/ghsa-6wxc-8mgq-w26m GHSA-6wxc-8mgq-w26m — Weblate: Stored HTML injection in editor search preview 2026-10-03T10:00:58.369245+00:00

Affected: PyPI: weblate

### Impact Weblate's live search preview renders unit `source` and `context` as HTML without escaping. Any contributor whose content reaches those fields stores HTML and CSS that runs inside the authenticated editor of every user who runs a matching search.

### Patches * https://github.com/WeblateOrg/weblate/pull/19422

### Workarounds Only the search preview on the selected views is affected.

### Resources Weblate thanks @adrgs for reporting this issue responsibly via GitHub.