CVE-2026-22250

EUVD-2026-1920
wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.0, the SSL verification would be skipped for some crafted URLs. This vulnerability is fixed in 1.17.0.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
2.5 LOW
LOCAL
HIGH
LOW
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N
GitHub_MCNA
2.5 LOW
LOCAL
HIGH
LOW
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Affected Products (NVD)
VendorProductVersion
weblatewlc
𝑥
< 1.17.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
wlc
bookworm
no-dsa
bullseye
no-dsa
forky
vulnerable
sid
vulnerable
trixie
no-dsa
Common Weakness Enumeration
References
https://github.com/WeblateOrg/wlc/commit/a513864ec4daad00146e6d6e039559726e256fa3
https://github.com/WeblateOrg/wlc/pull/1097
https://github.com/WeblateOrg/wlc/security/advisories/GHSA-2mmv-7rrp-g8xh