CVE-2026-34393

8.8 highEPSS 0.4%

Weblate is a web based localization tool. In versions prior to 5.17, the user patching API endpoint didn't properly limit the scope of edits. This issue has been fixed in version 5.17.

CVSS 3.1: 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.4% chance of exploitation in the next 30 days; higher than 32% of CVEs (scores of 2026-10-26)
CWE: CWE-269
Published: 2026-04-15
Modified: 2026-10-26
Record from: the NVD, synced 2026-10-26

Affected

weblate:weblate

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-3382-gw9x-477v	PyPI	weblate	<5.17	5.17
PYSEC-2026-155	PyPI	weblate	<5.17	5.17

References

https://github.com/WeblateOrg/weblate/pull/18687
https://github.com/WeblateOrg/weblate/security/advisories/GHSA-3382-gw9x-477v

Check your stack JSON