https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 14:50:53 +0000 https://cve.radiocsirt.org/vuln/cve-2026-42150 <p><strong>Affected:</strong> WeblateOrg wlc</p> <p>wlc is a Weblate command-line client using Weblate&#39;s REST API. Prior to version 2.0.0, the HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser. This issue has been patched in version 2.0.0.</p> <p><strong>Affected:</strong> WeblateOrg wlc</p> <p>wlc is a Weblate command-line client using Weblate&#39;s REST API. Prior to version 2.0.0, the HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser. This issue has been patched in version 2.0.0.</p> https://cve.radiocsirt.org/vuln/cve-2026-42150 https://cve.radiocsirt.org/vuln/ghsa-gx2m-mcc2-r4p3 <p><strong>Affected:</strong> PyPI: wlc</p> <p>### Impact The HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser.</p> <p>### Patches * https://github.com/WeblateOrg/wlc/pull/1327</p> <p>### Workarounds The only vulnerable code path is HTML output which is opt-in.</p> <p>### References Weblate thanks @fg0x0 for reporting this on GitHub.</p> <p><strong>Affected:</strong> PyPI: wlc</p> <p>### Impact The HTML output format in wlc embeds API response data into HTML without escaping, allowing cross-site scripting when the output is rendered in a browser.</p> <p>### Patches * https://github.com/WeblateOrg/wlc/pull/1327</p> <p>### Workarounds The only vulnerable code path is HTML output which is opt-in.</p> <p>### References Weblate thanks @fg0x0 for reporting this on GitHub.</p> https://cve.radiocsirt.org/vuln/ghsa-gx2m-mcc2-r4p3