Staging Environment: Content and features may be unstable or change without notice.

Advisory Package Curation

CVE-2026-50127

Progress 0 / 0

Advisory Summaries

github_osv/GHSA-vmfc-9982-2m45

Weblate SSRF: outbound URL guard misses some private ranges ### Impact Weblate's `VCS_RESTRICT_PRIVATE` did not properly account for some transitional IPv6 ranges, multicast addresses, or some semi-private IPv4 ranges, which allowed some addresses to bypass private range restrictions. ### Patches * https://github.com/WeblateOrg/weblate/pull/19768 ### Resources The issue was reported by @tonghuaroot via GitHub, and the same user also provided the initial patch.

gitlab/pypi/Weblate/CVE-2026-50127

Weblate SSRF: outbound URL guard misses some private ranges Weblate's `VCS_RESTRICT_PRIVATE` did not properly account for some transitional IPv6 ranges, multicast addresses, or some semi-private IPv4 ranges, which allowed some addresses to bypass private range restrictions.

pypa/weblate/PYSEC-2026-3416

Weblate SSRF: outbound URL guard misses some private ranges ### Impact Weblate's `VCS_RESTRICT_PRIVATE` did not properly account for some transitional IPv6 ranges, multicast addresses, or some semi-private IPv4 ranges, which allowed some addresses to bypass private range restrictions. ### Patches * https://github.com/WeblateOrg/weblate/pull/19768 ### Resources The issue was reported by @tonghuaroot via GitHub, and the same user also provided the initial patch.

pysec/PYSEC-2026-3416

Weblate SSRF: outbound URL guard misses some private ranges ### Impact Weblate's `VCS_RESTRICT_PRIVATE` did not properly account for some transitional IPv6 ranges, multicast addresses, or some semi-private IPv4 ranges, which allowed some addresses to bypass private range restrictions. ### Patches * https://github.com/WeblateOrg/weblate/pull/19768 ### Resources The issue was reported by @tonghuaroot via GitHub, and the same user also provided the initial patch.