CVE-2026-77573
Weblate: DNS rebinding in VCS operations allows server-side request forgery
CVSS score
3.5
EPSS probability
%0.2
Risk score
0.0
Published
1 mo ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
No verified public exploit code was found.
GitHub repositories, NVD exploit references and the Metasploit Framework were scanned. A record of active exploitation does not mean that public exploit code has been published.
Similar Vulnerabilities
7.7
CVE-2026-61792
Weblate path traversal allows a project administrator to read arbitrary files via App store metadata download (Incomplete Fix of CVE-2026-34242)
W
Patch status unknownEPSS %1
8.1
CVE-2026-55228
Weblate:: WebIDOR in GroupViewSet allows authenticated project manager to gain unauthorized read access to any private project
W
Patch status unknownEPSS %0
6.5
CVE-2026-62326
Weblate Has Uncontrolled Resource Consumption via
W
Patch status unknownEPSS %1
8.5
CVE-2026-86035
Weblate: Mercurial argument injection via repository filenames allows authenticated command execution
W
Patch status unknownEPSS %0
5.3
CVE-2026-77507
Weblate: Object-scoped RSS feeds disclose private change history to unauthorized users
W
Patch status unknownEPSS %0
4.4
CVE-2026-61790
Weblate: Team-enforced 2FA is bypassed for global permissions
W
Patch status unknownEPSS %0
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-77573"