https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T14:12:22.855637+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-265963 EUVD-2026-265963 2026-10-02T14:12:22.904000+00:00 EUVD-2026-265963 https://cve.radiocsirt.org/vuln/fkie_cve-2026-23535 fkie_cve-2026-23535 2026-10-02T14:12:22.904036+00:00

wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.2, the multi-translation download could write to an arbitrary location when instructed by a crafted server. This vulnerability is fixed in 1.17.2.

 https://cve.radiocsirt.org/vuln/ghsa-mmwx-79f6-67jg GHSA-mmwx-79f6-67jg — Weblate wlc path traversal vulnerability: Unsanitized API slugs in download command 2026-10-02T14:12:22.904072+00:00

Affected: PyPI: wlc

### Impact Multi-translation download could write to an arbitrary location when instructed by a crafted server.

### Patches * https://github.com/WeblateOrg/wlc/pull/1128

### Workarounds Do not use `wlc download` with untrusted servers.

### References This issue was reported to us by [wh1zee](https://hackerone.com/wh1zee) via HackerOne.

 https://cve.radiocsirt.org/vuln/pysec-2026-2053 PYSEC-2026-2053 — Weblate wlc path traversal vulnerability: Unsanitized API slugs in download command 2026-10-02T14:12:22.904101+00:00

Affected: PyPI: wlc

### Impact Multi-translation download could write to an arbitrary location when instructed by a crafted server.

### Patches * https://github.com/WeblateOrg/wlc/pull/1128

### Workarounds Do not use `wlc download` with untrusted servers.

### References This issue was reported to us by [wh1zee](https://hackerone.com/wh1zee) via HackerOne.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-23535 UBUNTU-CVE-2026-23535 2026-10-02T14:12:22.904124+00:00

Affected: Ubuntu:Pro:18.04:LTS: wlc, Ubuntu:Pro:20.04:LTS: wlc, Ubuntu:Pro:22.04:LTS: wlc, Ubuntu:Pro:24.04:LTS: wlc, Ubuntu:25.10: wlc, Ubuntu:26.04:LTS: wlc

wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.2, the multi-translation download could write to an arbitrary location when instructed by a crafted server. This vulnerability is fixed in 1.17.2.