CVE-2026-62364

LowCVSS 2.3/10Last modified Sep 26, 2026

Description

wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through WLC_KEY or --key without a matching WLC_URL or --url. When wlc runs in an untrusted repository, pull request checkout, or directory with untrusted ancestor configuration, it can send the token to an attacker-controlled project-configured URL. URL-scoped keys in [keys] are not affected. This issue is fixed in version 2.0.1.

Metrics

CVSS 3.1 2.3/10CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-200 CWE-349

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 22, 2026
Last modified: Sep 26, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-623677.5Vikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an administrator enables the per-provi CVE-2026-623688.4Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in Custom CVE-2026-623698.1KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 un CVE-2026-62376.4The Quick Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style' attribute of the 'qtbl' shortcode in all v CVE-2026-623706.5KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.0.0 unt CVE-2026-623718.8KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.12.0 un CVE-2026-623768.1Vikunja is an open-source self-hosted task management platform. Versions prior to 2.4.0 store password-reset, email-confirmation, and accoun CVE-2026-623774.3libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heif_context_read_fro CVE-2026-623789.0RustFS Console is a web management console for the RustFS distributed file system. From 0.1.7 until 0.1.10, the RustFS Console components/ob CVE-2026-623799.8Open Access Management (OpenAM) is an access management solution. Prior to 16.1.2, the pre-authentication /authservice PLL endpoint accepts CVE-2026-62386.5The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA CVE-2026-623807.5Netty (io.netty:netty-codec-socks) versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and cr