pyload-ng

HIGH 8.7

PyPI

CVE-2026-45348

pyLoad is vulnerable to stored XSS in Downloads view via unsanitized link URL in packages.js template literal

May 14, 2026

MEDIUM 5.0

PyPI

CVE-2026-46561

pyload-ng: SSRF via HTTP Redirect Bypass in parse_urls API

May 21, 2026

MEDIUM 6.5

PyPI

CVE-2026-45306

pyLoad Has Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory in pyLoad

May 14, 2026

HIGH 8.3

PyPI

CVE-2026-42313

pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy via unrestricted `proxy.*` config (incomplete fix for CVE-2026-33509 / -35463 / -35464 / -35586)

May 4, 2026

MEDIUM 6.8

PyPI

CVE-2026-42312

pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification via unrestricted `ssl_verify` config (incomplete fix for CVE-2026-33509 / -35463 / -35464 / -35586)

May 4, 2026

MEDIUM 6.5

PyPI

CVE-2026-42314

PyLoad Vulnerable to Path Traversal via Package Folder Name

May 5, 2026

HIGH 8.1

PyPI

CVE-2026-42315

PyLoad vulnerable to Path Traversal via Package Folder Name in set_package_data

May 5, 2026

MEDIUM 5.3

PyPI

CVE-2026-35592

pyload-ng: Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix Bypass

Apr 8, 2026

MEDIUM 4.8

PyPI

CVE-2026-40594

pyLoad has a Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)

Apr 16, 2026

MEDIUM 6.8

PyPI

CVE-2026-35586

pyload-ng: Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ng

Apr 8, 2026

CRITICAL 9.1

PyPI

CVE-2024-47821

pyLoad vulnerable to remote code execution by download to /.pyload/scripts using /flashgot API

Oct 28, 2024

MEDIUM 6.5

PyPI

CVE-2026-33314

Improper Authentication and Origin Validation Error in pyload-ng

Mar 19, 2026

HIGH 7.1

PyPI

CVE-2026-29778

pyLoad has an Arbitrary File Write via Path Traversal in edit_package()

Mar 5, 2026

LOW 2.3

PyPI

CVE-2024-47821

CVE-2024-47821

Oct 25, 2024

MEDIUM 6.5

PyPI

CVE-2026-42315

CVE-2026-42315

May 11, 2026

MEDIUM 6.5

PyPI

CVE-2026-42314

CVE-2026-42314

May 11, 2026

HIGH 8.3

PyPI

CVE-2026-42313

CVE-2026-42313

May 11, 2026

MEDIUM 6.8

PyPI

CVE-2026-42312

CVE-2026-42312

May 11, 2026

MEDIUM 4.8

PyPI

CVE-2026-40594

CVE-2026-40594

Apr 21, 2026

MEDIUM 6.5

PyPI

CVE-2026-35592

CVE-2026-35592

Apr 7, 2026

MEDIUM 6.8

PyPI

CVE-2026-35586

CVE-2026-35586

Apr 7, 2026

MEDIUM 6.5

PyPI

CVE-2026-33314

CVE-2026-33314

Mar 24, 2026

MEDIUM 6.5

PyPI

CVE-2026-29778

CVE-2026-29778

Mar 7, 2026

MEDIUM 5.3

PyPI

CVE-2026-44226

PyLoad vulnerable to unauthenticated traceback disclosure via global exception handler in WebUI

May 6, 2026

HIGH 8.8

PyPI

CVE-2026-41133

pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)

Apr 14, 2026

HIGH 8.1

PyPI

CVE-2025-61773

pyLoad CNL and captcha handlers allow Code Injection via unsanitized parameters

Oct 9, 2025

HIGH 7.6

PyPI

CVE-2023-47890

Download to arbitrary folder can lead to RCE

Nov 21, 2023

UNKNOWN

PyPI

GHSA-fj52-5g4h-gmq8

pyLoad's Session Not Invalidated After Permission Changes

Apr 14, 2026

MEDIUM 5.4

PyPI

CVE-2026-40071

pyload-ng has a WebUI JSON permission mismatch that lets ADD/DELETE users invoke MODIFY-only actions

Apr 8, 2026

HIGH 8.8

PyPI

CVE-2026-35463

pyLoad: Improper Neutralization of Special Elements used in an OS Command

Apr 4, 2026

HIGH 7.5

PyPI

CVE-2026-35464

pyLoad: Unprotected storage_folder enables arbitrary file write to Flask session store and code execution (Incomplete fix for CVE-2026-33509)

Apr 4, 2026

UNKNOWN

PyPI

CVE-2026-35459

pyLoad: SSRF filter bypass via HTTP redirect in BaseDownloader (Incomplete fix for CVE-2026-33992)

Apr 4, 2026

HIGH 7.7

PyPI

CVE-2026-35187

pyLoad: SSRF in parse_urls API endpoint via unvalidated URL parameter

Apr 4, 2026

UNKNOWN

PyPI

CVE-2026-33992

pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration

Mar 27, 2026

HIGH 7.5

PyPI

CVE-2026-33509

pyLoad SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration

Mar 20, 2026

MEDIUM 6.1

PyPI

CVE-2024-1240

CVE-2024-1240

Nov 15, 2024

UNKNOWN

PyPI

CVE-2025-57751

Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs

Aug 21, 2025

UNKNOWN

PyPI

CVE-2025-55156

PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameter

Aug 12, 2025

CRITICAL 9.8

PyPI

CVE-2025-54802

pyLoad CNL Blueprint allows Path Traversal through `dlc_path` which leads to Remote Code Execution (RCE)

Aug 4, 2025

MEDIUM 4.3

PyPI

GHSA-3wwm-hjv7-23r3

Pyload log Injection via API /json/add_package in add_name parameter

Jul 30, 2025

HIGH 7.5

PyPI

CVE-2025-54140

`pyLoad` has Path Traversal Vulnerability in `json/upload` Endpoint that allows Arbitrary File Write

Jul 21, 2025

CRITICAL 9.8

PyPI

CVE-2025-53890

pyLoad vulnerable to XSS through insecure CAPTCHA

Jul 15, 2025

HIGH 7.5

PyPI

CVE-2025-7346

pyLoad is vulnerable to attacks that bypass localhost restrictions, enabling the creation of arbitrary packages

Jul 8, 2025

UNKNOWN

PyPI

GHSA-2wcm-vx67-3x4q

Duplicate Advisory: GHSA-x698-5hjm-w2m5

Jul 8, 2025

UNKNOWN

PyPI

GHSA-25pw-q952-x37g

Duplicate Advisory: pyload-ng vulnerable to RCE with js2py sandbox escape

Oct 28, 2024

CRITICAL 9.8

PyPI

CVE-2024-39205

pyload-ng vulnerable to RCE with js2py sandbox escape

Sep 9, 2024

CRITICAL 9.6

PyPI

CVE-2024-22416

Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation

Jan 19, 2024

CRITICAL 9.1

PyPI

CVE-2024-32880

pyLoad allows upload to arbitrary folder lead to RCE

Apr 24, 2024

MEDIUM 6.1

PyPI

CVE-2024-24808

pyLoad open redirect vulnerability due to improper validation of the is_safe_url function

Feb 5, 2024

MEDIUM 5.3

PyPI

CVE-2024-21645

pyload Log Injection vulnerability

Jan 8, 2024

HIGH 7.5

PyPI

CVE-2024-21644

pyload Unauthenticated Flask Configuration Leakage vulnerability

Jan 8, 2024

CRITICAL 9.8

PyPI

CVE-2023-0297

Code Injection in pyload-ng

Jan 14, 2023

HIGH 8.8

PyPI

CVE-2024-22416

CVE-2024-22416

Jan 18, 2024

HIGH 7.4

PyPI

CVE-2023-0509

Improper Certificate Validation in pyload-ng

Jan 27, 2023

MEDIUM 5.4

PyPI

CVE-2023-0488

Cross-site Scripting in pyload-ng

Jan 27, 2023

CRITICAL 9.8

PyPI

CVE-2023-0435

Excessive Attack Surface in pyload-ng

Jan 23, 2023

MEDIUM 5.4

PyPI

CVE-2023-0434

Improper Input Validation in pyload-ng

Jan 22, 2023

MEDIUM 6.5

PyPI

CVE-2023-0227

Pyload Insufficient Session Expiration vulnerability

Jan 12, 2023

MEDIUM 6.1

PyPI

CVE-2023-0057

pyLoad vulnerable to Improper Restriction of Rendered UI Layers or Frames

Jan 5, 2023

MEDIUM 5.3

PyPI

CVE-2023-0055

Pyload contains Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

Jan 5, 2023