PyPI/weblate CVE-2026-34393: high 8.8, EPSS 0.54%

Weblate is a web based localization tool. In versions prior to 5.17, the user patching API endpoint didn't properly limit the scope of edits. This issue has been fixed in version 5.17.

Action: Upgrade weblate to 5.17 or later.

pip install weblate==5.17

Affected

Fixed versions

Sources

• osv: PYSEC-2026-155
• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-3382-gw9x-477v
• https://github.com/WeblateOrg/weblate/pull/18687

CVE-2026-34393 · published 2026-04-15T19:16:36.070Z · modified 2026-05-20T09:19:24.017900Z · JSON