CVE-2025-64326

Weblate is a web based localization tool. In versions 5.14 and below, Weblate leaks the IP address of the project member inviting the user to the project in the audit log. The audit log includes IP addresses from admin-triggered actions, which can be viewed by invited users. This issue is fixed in version 5.14.1.

• CWE-212

• https://github.com/WeblateOrg/weblate/pull/16781Issue Tracking
• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-gr35-vpx2-qxhcPatch, Vendor Advisory

Published

Nov 6, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-64320Improper Neutralization of Input Used for LLM Prompting vuln…6.5
• CVE-2025-64321Improper Neutralization of Input Used for LLM Prompting vuln…5.3
• CVE-2025-64322Incorrect Permission Assignment for Critical Resource vulner…5.3
• CVE-2025-64323kgateway is a Cloud-Native API and AI Gateway. Versions 2.0.…5.3
• CVE-2025-64324KubeVirt is a virtual machine management add-on for Kubernet…7.7
• CVE-2025-64325Emby Server is a personal media server. Prior to version 4.8…9
• CVE-2025-64327ThinkDashboard is a self-hosted bookmark dashboard built wit…5.3
• CVE-2025-64328FreePBX Endpoint Manager is a module for managing telephony …7.2
• CVE-2025-64329containerd is an open-source container runtime. Versions 1.7…5.5
• CVE-2025-6433If a user visited a webpage with an invalid TLS certificate,…9.8
• CVE-2025-64330Suricata is a network IDS, IPS and NSM engine developed by t…7.5
• CVE-2025-64331Suricata is a network IDS, IPS and NSM engine developed by t…7.5