Approved changes feed: RSS · Atom
cpe:2.3:a:weblate:wlc:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Weblate (0f51e2aa-f53f-5256-ae08-bf0d4c252c31) |
|---|---|
| Product | Wlc (c1019223-9404-5e6e-8501-bce2eac3a0bc) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-42150 |
vulnerable | 2026-06-08 08:03:15.955007 |
wlc: print_html outputs API data without HTML escaping, enabling stored XSS
MEDIUM (5.1)
wlc is a Weblate command-line client using Weblate's REST API. Prior to version 2.0.0, the HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser. This issue has been patched in version 2.0.0.
Published: 2026-05-08T03:23:12.234Z
Updated: 2026-05-08T21:28:38.342Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-23535 |
vulnerable | 2026-06-08 07:51:15.580142 |
wlc Path traversal: Unsanitized API slugs in download command
HIGH (8.1)
wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.2, the multi-translation download could write to an arbitrary location when instructed by a crafted server. This vulnerability is fixed in 1.17.2.
Published: 2026-01-16T19:08:24.882Z
Updated: 2026-01-16T19:21:22.629Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-22251 |
vulnerable | 2026-06-08 07:49:17.779008 |
wlc may leak API keys due to an insecure API key configuration
MEDIUM (5.3)
wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, wlc supported providing unscoped API keys in the setting. This practice was discouraged for years, but the code was never removed. This might cause the API key to be leaked to different servers.
Published: 2026-01-12T17:55:09.699Z
Updated: 2026-01-12T18:43:53.664Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-22250 |
vulnerable | 2026-06-08 07:49:17.778648 |
wlc can skip SSL verification
LOW (2.5)
wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, the SSL verification would be skipped for some crafted URLs. This vulnerability is fixed in 1.17.0.
Published: 2026-01-12T17:52:01.390Z
Updated: 2026-01-12T18:07:33.376Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.