Vendorspyload-ng Projectpyload-ngany version
Vulnerabilities

pyload-ng Project pyload-ng any version

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

19CVEs
CVE-2026-33511
pyload-ng: Authentication Bypass via Host Header Injection in ClickNLoad
Published 2026-03-24 · Analyzed
9.8EPSS 0.006
CVE-2024-22416
Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation
Published 2024-01-17 · Modified
9.6EPSS 0.009
CVE-2023-0488
Cross-site Scripting (XSS) - Stored in pyload/pyload
Published 2023-01-26 · Modified
9.6EPSS 0.008
CVE-2026-35459
pyLoad has SSRF fix bypass via HTTP redirect
Published 2026-04-06 · Analyzed
9.3EPSS 0.004
CVE-2026-35463
pyLoad has Improper Neutralization of Special Elements used in an OS Command
Published 2026-04-07 · Analyzed
8.8EPSS 0.009
CVE-2026-33509
pyload-ng: SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration
Published 2026-03-24 · Analyzed
8.8EPSS 0.006
CVE-2026-42313
pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy
Published 2026-05-11 · Analyzed
8.3EPSS 0.004
CVE-2026-42315
pyLoad: Path Traversal via Package Folder Name in set_package_data
Published 2026-05-11 · Analyzed
8.1EPSS 0.005
CVE-2026-32808
pyLoad: Arbitrary File Deletion via Path Traversal during Encrypted 7z Password Verification
Published 2026-03-20 · Analyzed
8.1EPSS 0.005
CVE-2026-35187
pyLoad has SSRF in parse_urls API endpoint via unvalidated URL parameter
Published 2026-04-06 · Analyzed
7.7EPSS 0.004
CVE-2023-0509
Improper Certificate Validation in pyload/pyload
Published 2023-01-26 · Modified
7.4EPSS 0.005
CVE-2026-29778
pyLoad: Arbitrary File Write via Path Traversal in edit_package()
Published 2026-03-07 · Analyzed
7.1EPSS 0.005
CVE-2026-35586
Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ng
Published 2026-04-07 · Analyzed
6.8EPSS 0.002
CVE-2026-42312
pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification
Published 2026-05-11 · Analyzed
6.8EPSS 0.002
CVE-2026-42314
pyLoad: Path Traversal via Package Folder Name
Published 2026-05-11 · Analyzed
6.5EPSS 0.004
CVE-2026-35592
pyLoad has an Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix Bypass
Published 2026-04-07 · Analyzed
6.5EPSS 0.004
CVE-2026-33314
pyload-ng: Improper Authentication and Origin Validation Error
Published 2026-03-24 · Analyzed
6.5EPSS 0.002
CVE-2023-0057
Improper Restriction of Rendered UI Layers or Frames in pyload/pyload
Published 2023-01-05 · Modified
6.1EPSS 0.005
CVE-2026-40594
pyLoad: Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)
Published 2026-04-21 · Analyzed
4.8EPSS 0.002