Tolgee is a localization and translation management platform with a focused vulnerability footprint centered on its single core product. The recurring weakness classes—missing authorization, exposure of sensitive information, input-validation flaws, cross-site scripting, and XML external entity handling—reflect the data-handling and web-interface risks inherent to a platform that ingests and serves user-generated translation content. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Tolgee over time
Signals from CVEs in this vendor scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-32251MEDIUM Tolgee is an open-source localization platform. Prior to 3.166.3, the XML parsers used for importing Android XML resources (.xml) and .resx files don't disable external entity proc | Mar 12, 2026 | 6.5 | 25 | NO | NO |
CVE-2023-38510HIGH Tolgee is an open-source localization platform. Starting in version 3.14.0 and prior to version 3.23.1, when a request is made using an API key, the backend fails to verify the per | Jul 27, 2023 | 8.1 | 22 | NO | NO |
CVE-2024-52297HIGH Tolgee is an open-source localization platform. Tolgee 3.81.1 included the all configuration properties in the PublicConfiguratioDTO publicly exposed to users. This vulnerability i | Nov 12, 2024 | 7.5 | 21 | NO | NO |
CVE-2024-32470MEDIUM Tolgee is an open-source localization platform. When API key created by admin user is used it bypasses the permission check at all. This error was introduced in v3.57.2 and immedia | Apr 18, 2024 | 6.5 | 18 | NO | NO |
CVE-2023-41316MEDIUM Tolgee is an open-source localization platform. Due to lack of validation field - Org Name, bad actor can send emails with HTML injected code to the victims. Registered users can i | Sep 7, 2023 | 5.4 | 18 | NO | NO |
CVE-2024-32466MEDIUM Tolgee is an open-source localization platform. For the `/v2/projects/translations` and `/v2/projects/{projectId}/translations` endpoints, translation data was returned even when A | Apr 18, 2024 | 4.3 | 15 | NO | NO |
Signals from CVEs in this vendor scope (6 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Tolgee.
Media articles that mention a CVE ID that affects a product developed by Tolgee — matched by CVE ID, not by vendor name.