Log in Start free

Pyload

Products

ProductCVEsExploitedLatest
Pyload40–Oct 9, 2026
pyload/pyload9–Nov 15, 2024

Exploited and recent CVEs

  • CVE-2026-75597 Medium 5.3 pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo 0.3%
  • CVE-2026-48484 Medium 6.5 pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination 0.4%
  • CVE-2026-48987 Medium 6.5 pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager 0.4%
  • CVE-2026-48737 Medium 4.9 pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs 0.3%
  • CVE-2026-45306 Medium 6.5 pyLoad: Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory 0.2%
  • CVE-2026-45348 High 8.7 pyLoad: Stored XSS in Downloads view via unsanitized link URL in packages.js template literal 0.2%
  • CVE-2026-46561 Medium 5.0 pyLoad: SSRF via HTTP Redirect Bypass in parse_urls API 0.2%
  • CVE-2026-44226 Medium 5.3 pyLoad: Unauthenticated traceback disclosure via global exception handler in WebUI 0.3%
  • CVE-2026-42315 High 8.1 pyLoad: Path Traversal via Package Folder Name in set_package_data 0.4%
  • CVE-2026-42314 Medium 6.5 pyLoad: Path Traversal via Package Folder Name 0.3%
  • CVE-2026-42312 Medium 6.8 pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification 0.2%
  • CVE-2026-42313 High 8.3 pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy 0.4%
  • CVE-2026-41133 High 8.8 pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass) 0.3%
  • CVE-2026-40594 Medium 4.8 pyLoad: Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition) 0.2%
  • CVE-2026-40071 Medium 5.4 pyLoad WebUI JSON permission mismatch lets ADD/DELETE users invoke MODIFY-only actions 0.2%
  • CVE-2026-35592 Medium 5.3 pyLoad has an Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix Bypass 0.3%
  • CVE-2026-35586 Medium 6.8 Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ng 0.1%
  • CVE-2026-35464 High 7.5 pyLoad has an incomplete fix for CVE-2026-33509: unprotected storage_folder enables arbitrary file write to Flask session store and code execution 0.5%
  • CVE-2026-35463 High 8.8 pyLoad has Improper Neutralization of Special Elements used in an OS Command 0.8%
  • CVE-2026-35459 Critical 9.1 pyLoad has SSRF fix bypass via HTTP redirect 0.3%
  • CVE-2026-35187 High 7.7 pyLoad has SSRF in parse_urls API endpoint via unvalidated URL parameter 0.3%
  • CVE-2026-33992 Critical 9.3 pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration 0.4%
  • CVE-2026-33511 High 8.8 pyload-ng: Authentication Bypass via Host Header Injection in ClickNLoad 0.4%
  • CVE-2026-33509 High 7.5 pyload-ng: SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration 0.5%
  • CVE-2026-33314 Medium 6.5 pyload-ng: Improper Authentication and Origin Validation Error 0.2%
  • CVE-2026-32808 High 8.1 pyLoad: Arbitrary File Deletion via Path Traversal during Encrypted 7z Password Verification 0.3%
  • CVE-2026-29778 High 7.1 pyLoad: Arbitrary File Write via Path Traversal in edit_package() 0.6%
  • CVE-2025-61773 High 8.1 pyLoad CNL and captcha handlers allow code Injection via unsanitized parameters 0.5%
  • CVE-2025-57751 High 7.7 Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs 0.3%
  • CVE-2025-55156 High 7.8 PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameter 0.4%