https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 08:12:57 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-274003 EUVD-2026-274003 https://cve.radiocsirt.org/vuln/euvd-2026-274003 https://cve.radiocsirt.org/vuln/fkie_cve-2026-27457 <p>Weblate is a web based localization tool. Prior to version 5.16.1, the REST API&#39;s `AddonViewSet` (`weblate/api/views.py`, line 2831) uses `queryset = Addon.objects.all()` without overriding `get_queryset()` to scope results by user permissions. This allows any authenticated user (or anonymous users if `REQUIRE_LOGIN` is not set) to list and retrieve ALL addons across all projects and components via `GET /api/addons/` and `GET /api/addons/{id}/`. Version 5.16.1 fixes the issue.</p> <p>Weblate is a web based localization tool. Prior to version 5.16.1, the REST API&#39;s `AddonViewSet` (`weblate/api/views.py`, line 2831) uses `queryset = Addon.objects.all()` without overriding `get_queryset()` to scope results by user permissions. This allows any authenticated user (or anonymous users if `REQUIRE_LOGIN` is not set) to list and retrieve ALL addons across all projects and components via `GET /api/addons/` and `GET /api/addons/{id}/`. Version 5.16.1 fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-27457 https://cve.radiocsirt.org/vuln/ghsa-wppc-7cq7-cgfv <p><strong>Affected:</strong> PyPI: weblate</p> <p>### Impact</p> <p>Users were able to obtain add-on configuration via API.</p> <p>### Patches</p> <p>* https://github.com/WeblateOrg/weblate/pull/18107 * https://github.com/WeblateOrg/weblate/pull/18164</p> <p>### References</p> <p>Weblate thanks @lighthousekeeper1212 for responsible disclosure.</p> <p><strong>Affected:</strong> PyPI: weblate</p> <p>### Impact</p> <p>Users were able to obtain add-on configuration via API.</p> <p>### Patches</p> <p>* https://github.com/WeblateOrg/weblate/pull/18107 * https://github.com/WeblateOrg/weblate/pull/18164</p> <p>### References</p> <p>Weblate thanks @lighthousekeeper1212 for responsible disclosure.</p> https://cve.radiocsirt.org/vuln/ghsa-wppc-7cq7-cgfv https://cve.radiocsirt.org/vuln/opensuse-su-2026:10309-1 <p>weblate-5.16.1-1.1 on GA media</p> <p>weblate-5.16.1-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10309-1 https://cve.radiocsirt.org/vuln/pysec-2026-2310 <p><strong>Affected:</strong> PyPI: weblate</p> <p>Weblate is a web based localization tool. Prior to version 5.16.1, the REST API&#39;s `AddonViewSet` (`weblate/api/views.py`, line 2831) uses `queryset = Addon.objects.all()` without overriding `get_queryset()` to scope results by user permissions. This allows any authenticated user (or anonymous users if `REQUIRE_LOGIN` is not set) to list and retrieve ALL addons across all projects and components via `GET /api/addons/` and `GET /api/addons/{id}/`. Version 5.16.1 fixes the issue.</p> <p><strong>Affected:</strong> PyPI: weblate</p> <p>Weblate is a web based localization tool. Prior to version 5.16.1, the REST API&#39;s `AddonViewSet` (`weblate/api/views.py`, line 2831) uses `queryset = Addon.objects.all()` without overriding `get_queryset()` to scope results by user permissions. This allows any authenticated user (or anonymous users if `REQUIRE_LOGIN` is not set) to list and retrieve ALL addons across all projects and components via `GET /api/addons/` and `GET /api/addons/{id}/`. Version 5.16.1 fixes the issue.</p> https://cve.radiocsirt.org/vuln/pysec-2026-2310