CVE-2026-45106
Medium · 4.6CVSS
4.6
EPSS
0.3%
Published
Jun 10, 2026
CISA due date
—
The record
Weblate is a web based localization tool. Prior to version 2026.5, Weblate's live search preview renders unit source and context as HTML without escaping. Any contributor whose content reaches those fields stores HTML and CSS that runs inside the authenticated editor of every user who runs a matching search. This issue has been patched in version 2026.5.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | weblate | 0 | 5.17.1-2.1 |
Related vulnerabilities
- CVE-2026-50127 Weblate is a web based localization tool. Also affects weblate
- CVE-2026-44263 Weblate is a web based localization tool. Also affects weblate
- CVE-2026-44264 Weblate is a web based localization tool. Also affects weblate
- CVE-2026-41519 Weblate is a web based localization tool. Also affects weblate
- CVE-2026-41654 Weblate is a web based localization tool. Also affects weblate
- CVE-2026-27457 Weblate is a web based localization tool. Also affects weblate
- CVE-2026-21889 Weblate leaks information via screenshots Also affects weblate
- CVE-2025-68398 Weblate is a web based localization tool. Also affects weblate