https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T21:17:08.738237+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-50127 CVE-2026-50127 — Weblate SSRF: outbound URL guard misses the NAT64 well-known prefix (64:ff9b::/96) 2026-10-02T21:17:08.739737+00:00

Affected: WeblateOrg weblate

Weblate is a web based localization tool. From version 5.15 to before version 2026.6, Weblate's VCS_RESTRICT_PRIVATE did not properly account for some transitional IPv6 ranges, multicast addresses, or some semi-private IPv4 ranges, which allowed some addresses to bypass private range restrictions. This issue has been patched in version 2026.6.

 https://cve.radiocsirt.org/vuln/ghsa-vmfc-9982-2m45 GHSA-vmfc-9982-2m45 — Weblate SSRF: outbound URL guard misses some private ranges 2026-10-02T21:17:08.739792+00:00

Affected: PyPI: weblate

### Impact

Weblate's `VCS_RESTRICT_PRIVATE` did not properly account for some transitional IPv6 ranges, multicast addresses, or some semi-private IPv4 ranges, which allowed some addresses to bypass private range restrictions.

### Patches

* https://github.com/WeblateOrg/weblate/pull/19768

### Resources

The issue was reported by @tonghuaroot via GitHub, and the same user also provided the initial patch.