CVE-2026-22251

Опубликовано: 12 янв. 2026

Источник: nvd

CVSS3: 5.3

CVSS3: 5.5

EPSS Низкий

Описание

wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, wlc supported providing unscoped API keys in the setting. This practice was discouraged for years, but the code was never removed. This might cause the API key to be leaked to different servers.

Ссылки

https://github.com/WeblateOrg/wlc/commit/aafdb507a9e66574ade1f68c50c4fe75dbe80797
Patch
https://github.com/WeblateOrg/wlc/pull/1098
Issue Tracking
https://github.com/WeblateOrg/wlc/security/advisories/GHSA-9rp8-h4g8-8766
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:weblate:wlc:*:*:*:*:*:*:*:*

Версия до 1.17.0 (исключая)

EPSS

Процентиль: 0%

0.00005

Низкий

5.3 Medium

CVSS3

5.5 Medium

CVSS3

Дефекты

CWE-200

NVD-CWE-noinfo

Связанные уязвимости

CVE-2026-22251

CVSS3: 5.3

ubuntu

3 месяца назад

CVE-2026-22251

CVSS3: 5.3

debian

3 месяца назад

wlc is a Weblate command-line client using Weblate's REST API. Prior t ...

GHSA-9rp8-h4g8-8766

CVSS3: 5.3

github

3 месяца назад

Weblate wlc has insecure API key configuration

EPSS

Процентиль: 0%

0.00005

Низкий

5.3 Medium

CVSS3

5.5 Medium

CVSS3

Дефекты

CWE-200

NVD-CWE-noinfo