Skip to content

RadicalNotion.AI

We do not sell or share your personal information.

© 2026 RadicalNotion.AI

Security Data

CWE Directory
CAPEC Directory
CNA Directory
CNA Leaderboard
CNA Report Cards
Vendor Directory
Patched Functions
Data Sources

Calculators

CVSS Calculator
CVSS 4.0
CVSS 3.1
CVSS 3.0
CVSS 2.0
Badge Builder

Platform

My Vulnerabilities
Insights
Notifications
Pricing

Learn

Guides
What is a CVE?
What is CVSS?
The CISA KEV catalog
What is EPSS?

Company

About
Blog
Careers
Contact
Demo

Account

Sign up
Log in

Legal

Security
Privacy
Terms

RadicalNotion.AI

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities and report cards
VendorsVulnerabilities by vendor
Patched FunctionsWhere CVE fixes land in code

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0
Badge BuilderEmbeddable SVG badges for READMEs

Resources

LearnSecurity guides
Data SourcesCVE data sources

About Blog Pricing Demo

Log in Create an account

Home
Patched Functions
Weblateorg
Weblate

WeblateOrg/weblate: Functions Patched by CVE Fixes

python

javascript

#93 of 500 repositories

WeblateOrg/weblate

Functions and files changed by CVE fixes in this repository.

Latest located fix September 29, 2026

43

CVE fixes located

Published CVEs

280

Functions patched

Distinct function sites

79

Files patched

Distinct source files

2017–2026

Years covered

By CVE publication date

Overview

43 published CVEs have a fix traced to functions in WeblateOrg/weblate, the earliest published in 2017. Those fixes changed 280 distinct functions across 79 files, in 922 patch hunks.

Among the 500 repositories tracked here, WeblateOrg/weblate ranks #93 by the number of CVEs with a located fix.

Most patched functions

Functions in WeblateOrg/weblate changed by the most CVE fixes.

1get_remote_branchweblate/vcs/git.py3 CVEs · 5 patches2022 to 2026
2validateweblate/api/serializers.py3 CVEs · 4 patches2026
3commitweblate/vcs/mercurial.py2 CVEs · 4 patches2026
4get_fileweblate/vcs/mercurial.py2 CVEs · 4 patches2026
5zip_downloadweblate/utils/views.py2 CVEs · 4 patches2025 to 2026
6addweblate/trans/models/component.py2 CVEs · 3 patches2026
7validate_remote_urlweblate/vcs/base.py2 CVEs · 3 patches2026
8_cloneweblate/vcs/git.py2 CVEs · 3 patches2022 to 2026
9add_host_keyweblate/vcs/ssh.py2 CVEs · 3 patches2026
10configure_remoteweblate/vcs/git.py2 CVEs · 3 patches2026
11executeweblate/vcs/base.py2 CVEs · 3 patches2026
12push_to_forkweblate/vcs/git.py2 CVEs · 3 patches2026
13sshweblate/wladmin/views.py2 CVEs · 3 patches2026
14get_taskweblate/api/views.py2 CVEs · 3 patches2026
15_popenweblate/vcs/base.py2 CVEs · 3 patches2025 to 2026

Most patched files

Files in WeblateOrg/weblate changed by the most CVE fixes.

1weblate/api/views.py10 CVEs · 24 functions
2weblate/trans/models/component.py6 CVEs · 15 functions
3weblate/vcs/base.py6 CVEs · 15 functions
4weblate/utils/validators.py6 CVEs · 7 functions
5weblate/vcs/git.py5 CVEs · 40 functions
6weblate/api/serializers.py5 CVEs · 10 functions
7weblate/vcs/mercurial.py4 CVEs · 19 functions
8weblate/trans/backups.py4 CVEs · 6 functions
9weblate/utils/files.py4 CVEs · 5 functions
10weblate/settings_docker.py4 CVEs · 0 functions

Fix size

How much code a CVE fix in WeblateOrg/weblate changes, with backports counted once.

70

Median lines changed

Added plus removed, per CVE

23%

Fixes of 20 lines or fewer

Share of CVE fixes

14%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in WeblateOrg/weblate, and the functions each fix changed.

Weblate: Mercurial argument injection via repository filenames allows authenticated command execution
CVE-2026-86035commit get_file
High · CVSS 8.5
EPSS 0.4%2026-09-29
Weblate: DNS rebinding in VCS operations allows server-side request forgery
CVE-2026-77573validate_repo_url connect_to_addresses _getenv
Low · CVSS 3.5
EPSS 0.2%2026-08-26
Weblate: Object-scoped RSS feeds disclose private change history to unauthorized users
CVE-2026-77507title FeedObject get_object
Medium · CVSS 5.3
EPSS 0.4%2026-08-26
Weblate Has Uncontrolled Resource Consumption via
CVE-2026-62326check_target_params report_regex_timeout check_highlight
Medium · CVSS 6.5
EPSS 0.5%2026-08-26
Weblate: Restricted-component change history leaked to non-member project users through the nested `GET /api/projects/{slug}/changes/` endpoint
CVE-2026-62249changes
Medium · CVSS 4.3
EPSS 0.3%2026-08-26
Weblate path traversal allows a project administrator to read arbitrary files via App store metadata download (Incomplete Fix of CVE-2026-34242)
CVE-2026-61792iter_files _is_download_path is_unsafe_path
High · CVSS 7.7
EPSS 0.6%2026-08-26
Weblate: Team-enforced 2FA is bypassed for global permissions
CVE-2026-61790unlimited_for_user
Medium · CVSS 4.4
EPSS 0.4%2026-08-26
Weblate:: WebIDOR in GroupViewSet allows authenticated project manager to gain unauthorized read access to any private project
CVE-2026-55228validate DefiningWorkspaceField scoped_assignment_check
High · CVSS 8.1
EPSS 0.4%2026-08-26
Observable object existence disclosure in private Weblate projects via globally scoped object lookups
CVE-2026-55227filter_access show_change delete_comment
Medium · CVSS 4.3
EPSS 0.3%2026-08-26
Weblate: Unverified REST API email changes
CVE-2026-77508validate_email
Low · CVSS 3.5
EPSS 0.3%2026-08-26
Weblate: Stored HTML injection in editor search preview
CVE-2026-45106ajax parse after
Medium · CVSS 4.6
EPSS 0.3%2026-06-10
Weblate SSRF: outbound URL guard misses the NAT64 well-known prefix (64:ff9b::/96)
CVE-2026-50127_unwrap_ipv6_transition _parse_ip validate_untrusted_hostname
Medium · CVSS 5.9
EPSS 0.5%2026-06-10

Get an alert for each new WeblateOrg/weblate CVE, with the patched functions and AI-written analysis.

Monitor weblate CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

argoproj/argo-cd43 CVEs coollabsio/coolify43 CVEs grafana/grafana43 CVEs LimeSurvey/LimeSurvey43 CVEs android.googlesource.com/platform-packages-apps-Settings44 CVEs Dokploy/dokploy44 CVEs envoyproxy/envoy44 CVEs frappe/frappe44 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in WeblateOrg/weblate.

How many CVEs have a located fix in WeblateOrg/weblate?: 43 published CVEs have a fix traced to functions in WeblateOrg/weblate, touching 280 functions across 79 files.
Which function in WeblateOrg/weblate has been patched by the most CVEs?: get_remote_branch in weblate/vcs/git.py has been changed by 3 CVE fixes, from 2022 to 2026.
How large is a typical CVE fix in WeblateOrg/weblate?: The median fix changes 70 lines. 23% of fixes change 20 lines or fewer, and 14% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

WeblateOrg/weblate on GitHub (opens in a new tab)
Patched functions directory
CWE directory: the weakness types behind these fixes

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track WeblateOrg/weblate CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing

On this page

Overview
Most patched functions
Most patched files
Fix size
Latest CVEs
Other repositories
FAQ
References