https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 14:57:57 +0000 https://cve.radiocsirt.org/vuln/cve-2026-23535 <p><strong>Affected:</strong> WeblateOrg wlc</p> <p>wlc is a Weblate command-line client using Weblate&#39;s REST API. Prior to 1.17.2, the multi-translation download could write to an arbitrary location when instructed by a crafted server. This vulnerability is fixed in 1.17.2.</p> <p><strong>Affected:</strong> WeblateOrg wlc</p> <p>wlc is a Weblate command-line client using Weblate&#39;s REST API. Prior to 1.17.2, the multi-translation download could write to an arbitrary location when instructed by a crafted server. This vulnerability is fixed in 1.17.2.</p> https://cve.radiocsirt.org/vuln/cve-2026-23535 https://cve.radiocsirt.org/vuln/ghsa-mmwx-79f6-67jg <p><strong>Affected:</strong> PyPI: wlc</p> <p>### Impact Multi-translation download could write to an arbitrary location when instructed by a crafted server.</p> <p>### Patches * https://github.com/WeblateOrg/wlc/pull/1128</p> <p>### Workarounds Do not use `wlc download` with untrusted servers.</p> <p>### References This issue was reported to us by [wh1zee](https://hackerone.com/wh1zee) via HackerOne.</p> <p><strong>Affected:</strong> PyPI: wlc</p> <p>### Impact Multi-translation download could write to an arbitrary location when instructed by a crafted server.</p> <p>### Patches * https://github.com/WeblateOrg/wlc/pull/1128</p> <p>### Workarounds Do not use `wlc download` with untrusted servers.</p> <p>### References This issue was reported to us by [wh1zee](https://hackerone.com/wh1zee) via HackerOne.</p> https://cve.radiocsirt.org/vuln/ghsa-mmwx-79f6-67jg