CVE-2026-76274

Splunk Enterprise versions below 10.4.3 , 10.2.7 , and 10.0.10 are vulnerable to a Server-Side Request Forgery (SSRF) within the Splunk App for Splunk Observability Cloud . An attacker with a role possessing the read_o11y_content capability can exploit the REST API to redirect outbound requests t...

wlc may disclose API tokens to project-configured URLs

Impactwlc could send an unscoped API token to an unintended server when run inside a directory tree containing attacker-controlled project configuration.If .weblate, .weblate.ini, or weblate.ini defines an API url, and the user supplies a token with WLCKEY or --key without also pinning the URL, w...

wlc may disclose API tokens to project-configured URLs

Impact wlc could send an unscoped API token to an unintended server when run inside a directory tree containing attacker-controlled project configuration. If .weblate, .weblate.ini, or weblate.ini defines an API url, and the user supplies a token with WLCKEY or --key without also pinning the URL,...

GHSA-3MQQ-HV9C-85HC wlc may disclose API tokens to project-configured URLs

Impact wlc could send an unscoped API token to an unintended server when run inside a directory tree containing attacker-controlled project configuration. If .weblate, .weblate.ini, or weblate.ini defines an API url, and the user supplies a token with WLCKEY or --key without also pinning the URL,...

CVE-2026-62364

The wlc Weblate command-line client is vulnerable to unauthorized API token disclosure in versions prior to 2.0.1 . If an unscoped API token is provided via WLC_KEY or --key without an explicit WLC_URL or --url, the application may automatically use a project-configured URL from files like .webla...

CVE-2026-62364 wlc may disclose API tokens to project-configured URLs

wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through WLCKEY or --key without a matching WLCURL or --url. When wlc run...

CVE-2026-62364 wlc may disclose API tokens to project-configured URLs

wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through WLCKEY or --key without a matching WLCURL or --url. When wlc run...

CVE-2026-62364 wlc may disclose API tokens to project-configured URLs

wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through WLCKEY or --key without a matching WLCURL or --url. When wlc run...

CVE-2025-3415

A flaw exists in Grafana Alerting, where the DingDing contact-point integration URL can be revealed in plain text to users with viewer-level permissions due to misconfigured access control. This disclosure permits unauthorized users to view sensitive webhook URLs, including API tokens or keys,...

CVE-2019-1003045: Insufficiently Protected Credentials

A vulnerability in Jenkins ECS Publisher Plugin 1.0.0 and earlier allows attackers with Item/Extended Read permission, or local file system access to the Jenkins home directory to obtain the API token configured in this plugin's configuration...