{"cve":"CVE-2025-64326","nvd":{"published":"2025-11-06T21:15:43.957","modified":"2026-06-17T09:54:12.920","status":"Analyzed","description":"Weblate is a web based localization tool. In versions 5.14 and below,  Weblate leaks the IP address of the project member inviting the user to the project in the audit log. The audit log includes IP addresses from admin-triggered actions, which can be viewed by invited users. This issue is fixed in version 5.14.1.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","score":3.5},"cwes":["CWE-212"],"references":["https://github.com/WeblateOrg/weblate/pull/16781","https://github.com/WeblateOrg/weblate/security/advisories/GHSA-gr35-vpx2-qxhc"],"products":["weblate:weblate"],"source":"nvd","synced_at":"2026-10-19T22:14:53.307938015+00:00"},"epss":{"cve":"CVE-2025-64326","score":0.00199,"percentile":0.09718,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-gr35-vpx2-qxhc","url":"https://osv.dev/vulnerability/GHSA-gr35-vpx2-qxhc","summary":"Weblate leaks the IP of project member inviting user to be reviewer in Audit log","modified":"2026-06-06T00:45:47.834946213Z","packages":[{"ecosystem":"PyPI","name":"weblate","purl":"pkg:pypi/weblate","ranges":["<5.14.1"],"fixed":["5.14.1"]}]},{"id":"PYSEC-2025-126","url":"https://osv.dev/vulnerability/PYSEC-2025-126","summary":"","modified":"2026-05-20T09:19:04.874052Z","packages":[{"ecosystem":"PyPI","name":"late","purl":"pkg:pypi/late","ranges":["<5.14.1"],"fixed":["5.14.1"]}]},{"id":"PYSEC-2025-230","url":"https://osv.dev/vulnerability/PYSEC-2025-230","summary":"","modified":"2026-05-20T09:19:23.616964Z","packages":[{"ecosystem":"PyPI","name":"weblate","purl":"pkg:pypi/weblate","ranges":["<5.14.1"],"fixed":["5.14.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}