Threats affecting pkg:github/weblateorg/weblate

22 threats

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Low	2.1	EPSS 0.3%	CVE-2025-49134WeblateOrg weblate · Exposure of Private Personal Information to an Unauthorized Actor Low2.1EPSS 0.3%2025-06-16CVE Database V5CVE-2025-49134 Weblate is a web based localization tool. Prior to version 5.12, the audit log notifications included the full IP address of the acting user. This could be obtained by third-party servers such as SMTP relays, or spam filters. This issue has been patched in version 5.12. EPSS 0.3%Vulnerability CWE-359	CVE Database V5	2025-06-16
Medium	4.9	EPSS 0.3%	CVE-2025-47951WeblateOrg weblate · Improper Restriction of Excessive Authentication Attempts Medium4.9EPSS 0.3%2025-06-16CVE Database V5CVE-2025-47951 Weblate is a web based localization tool. Prior to version 5.12, the verification of the second factor was not subject to rate limiting. The absence of rate limiting on the second factor endpoint allows an attacker with valid credentials to automate OTP guessing. This issue has been patched in version 5.12. EPSS 0.3%Vulnerability CWE-307	CVE Database V5	2025-06-16

Page 2 of 2