CVE-2025-67492

Weblate is a web based localization tool. In versions prior to 5.15, it was possible to trigger repository updates for many repositories via a crafted webhook payload. Version 5.15 fixes the issue. As a workaround, disabling webhooks completely using ENABLE_HOOKS avoids this vulnerability.

• CWE-1286

• https://github.com/WeblateOrg/weblate/pull/17221Issue Tracking, Patch
• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-pj86-258h-qrvfPatch, Vendor Advisory

Published

Dec 16, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-67487Static Web Server (SWS) is a production-ready web server sui…8.6
• CVE-2025-67488SiYuan is self-hosted, open source personal knowledge manage…8.8
• CVE-2025-67489@vitejs/plugin-rs provides React Server Components (RSC) sup…9.8
• CVE-2025-6749A vulnerability classified as critical was found in huija bi…6.3
• CVE-2025-67490The Auth0 Next.js SDK is a library for implementing user aut…5.4
• CVE-2025-67491OpenEMR is a free and open source electronic health records …5.4
• CVE-2025-67493Homarr is an open-source dashboard. Prior to version 1.45.3,…9
• CVE-2025-67494ZITADEL is an open-source identity infrastructure tool. Vers…8.6
• CVE-2025-67495ZITADEL is an open-source identity infrastructure tool. Vers…6.1
• CVE-2025-67496WeGIA is an open source Web Manager for Institutions with a …5.4
• CVE-2025-67497Rejected reason: Further research determined the issue is no…
• CVE-2025-67498Rejected reason: Further research determined the issue is no…