What’s Vulnerable › Products

pyload vulnerabilities

34 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 29 published in the last 12 months.

Check whether your pyload version is affected

Latest pyload vulnerabilities

• CVE-2026-75597 — pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo (CVSS 5.3)
• CVE-2026-48484 — pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination (CVSS 6.5)
• CVE-2026-48987 — pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager (CVSS 6.5)
• CVE-2026-48737 — pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs (CVSS 4.9)
• CVE-2026-46561 — pyLoad: SSRF via HTTP Redirect Bypass in parse_urls API (CVSS 5.0)
• CVE-2026-45348 — pyLoad: Stored XSS in Downloads view via unsanitized link URL in packages.js template literal (CVSS 8.7)
• CVE-2026-45306 — pyLoad: Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory (CVSS 6.5)
• CVE-2026-42315 — pyLoad: Path Traversal via Package Folder Name in set_package_data (CVSS 6.5)
• CVE-2026-42314 — pyLoad: Path Traversal via Package Folder Name (CVSS 6.5)
• CVE-2026-42313 — pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy (CVSS 8.3)
• CVE-2026-42312 — pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification (CVSS 6.8)
• CVE-2026-40594 — pyLoad: Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition) (CVSS 4.8)
• CVE-2026-35592 — pyLoad has an Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix Bypass (CVSS 6.5)
• CVE-2026-35586 — Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ng (CVSS 6.8)
• CVE-2026-35463 — pyLoad has Improper Neutralization of Special Elements used in an OS Command (CVSS 8.8)
• CVE-2026-35459 — pyLoad has SSRF fix bypass via HTTP redirect (CVSS 9.1)
• CVE-2026-35187 — pyLoad has SSRF in parse_urls API endpoint via unvalidated URL parameter (CVSS 7.7)
• CVE-2026-33511 — pyload-ng: Authentication Bypass via Host Header Injection in ClickNLoad (CVSS 9.8)
• CVE-2026-33509 — pyload-ng: SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration (CVSS 8.8)
• CVE-2026-33314 — pyload-ng: Improper Authentication and Origin Validation Error (CVSS 6.5)
• CVE-2026-32808 — pyLoad: Arbitrary File Deletion via Path Traversal during Encrypted 7z Password Verification (CVSS 8.1)
• CVE-2026-29778 — pyLoad: Arbitrary File Write via Path Traversal in edit_package() (CVSS 6.5)
• CVE-2025-61773 — pyLoad CNL and captcha handlers allow code Injection via unsanitized parameters (CVSS 8.1)
• CVE-2025-57751 — Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs (CVSS 7.7)
• CVE-2025-55156 — PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameter (CVSS 7.8)