Staging Environment: Content and features may be unstable or change without notice.

Advisory Weakness Curation

CVE-2026-22251

Progress 0 / 0

Advisory Summaries

github_osv/GHSA-9rp8-h4g8-8766

Weblate wlc has insecure API key configuration ### Impact Historically, wlc supported providing unscoped API keys in the setting. This practice was discouraged for years, but the code was never removed. This might cause the API key to be used against different server. ### Patches * https://github.com/WeblateOrg/wlc/pull/1098 ### Workarounds Remove unscoped `key` from wlc configuration. Only use URL-scoped keys in the `[keys]` sections. ### References This issue was reported to us by wh1zee https://hackerone.com/wh1zee via HackerOne.

gitlab/pypi/wlc/CVE-2026-22251

Weblate wlc has insecure API key configuration Historically, wlc supported providing unscoped API keys in the setting. This practice was discouraged for years, but the code was never removed. This might cause the API key to be used against different server.