Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 16:01:38 +0000 CVE-2026-22251 — wlc may leak API keys due to an insecure API key configuration https://cve.radiocsirt.org/vuln/cve-2026-22251 <p><strong>Affected:</strong> WeblateOrg wlc</p> <p>wlc is a Weblate command-line client using Weblate&#39;s REST API. Prior to 1.17.0, wlc supported providing unscoped API keys in the setting. This practice was discouraged for years, but the code was never removed. This might cause the API key to be leaked to different servers.</p> <p><strong>Affected:</strong> WeblateOrg wlc</p> <p>wlc is a Weblate command-line client using Weblate&#39;s REST API. Prior to 1.17.0, wlc supported providing unscoped API keys in the setting. This practice was discouraged for years, but the code was never removed. This might cause the API key to be leaked to different servers.</p> https://cve.radiocsirt.org/vuln/cve-2026-22251 GHSA-9rp8-h4g8-8766 — Weblate wlc has insecure API key configuration https://cve.radiocsirt.org/vuln/ghsa-9rp8-h4g8-8766 <p><strong>Affected:</strong> PyPI: wlc</p> <p>### Impact Historically, wlc supported providing unscoped API keys in the setting. This practice was discouraged for years, but the code was never removed. This might cause the API key to be used against different server.</p> <p>### Patches * https://github.com/WeblateOrg/wlc/pull/1098</p> <p>### Workarounds Remove unscoped `key` from wlc configuration. Only use URL-scoped keys in the `[keys]` sections.</p> <p>### References This issue was reported to us by [wh1zee](https://hackerone.com/wh1zee) via HackerOne.</p> <p><strong>Affected:</strong> PyPI: wlc</p> <p>### Impact Historically, wlc supported providing unscoped API keys in the setting. This practice was discouraged for years, but the code was never removed. This might cause the API key to be used against different server.</p> <p>### Patches * https://github.com/WeblateOrg/wlc/pull/1098</p> <p>### Workarounds Remove unscoped `key` from wlc configuration. Only use URL-scoped keys in the `[keys]` sections.</p> <p>### References This issue was reported to us by [wh1zee](https://hackerone.com/wh1zee) via HackerOne.</p> https://cve.radiocsirt.org/vuln/ghsa-9rp8-h4g8-8766