# cve.now: Pyload The newest entries naming Pyload as an affected vendor (up to 200), of 53 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md. - [CVE-2026-123816](https://cve.now/CVE-2026-123816.md): pyLoad: Authentication bypass in API key validation (check\_apikey cache) (CVSS 8.1) - [CVE-2026-123815](https://cve.now/CVE-2026-123815.md): pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=) (CVSS 9.4) - [CVE-2026-123814](https://cve.now/CVE-2026-123814.md): pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host (CVSS 6.4) - [CVE-2026-123813](https://cve.now/CVE-2026-123813.md): pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session (CVSS 7.5) - [CVE-2026-75597](https://cve.now/CVE-2026-75597.md): pyLoad: Unauthenticated access to /web/\ bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo (CVSS 5.3) - [CVE-2026-48484](https://cve.now/CVE-2026-48484.md): pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination (CVSS 6.5) - [CVE-2026-48987](https://cve.now/CVE-2026-48987.md): pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager (CVSS 6.5) - [CVE-2026-48737](https://cve.now/CVE-2026-48737.md): pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs (CVSS 4.9) - [CVE-2026-45306](https://cve.now/CVE-2026-45306.md): pyLoad: Incomplete Fix for CVE-2026-33509 -storage\_folder Bypass via Session Directory (CVSS 6.5) - [CVE-2026-45348](https://cve.now/CVE-2026-45348.md): pyLoad: Stored XSS in Downloads view via unsanitized link URL in packages.js template literal (CVSS 8.7) - [CVE-2026-46561](https://cve.now/CVE-2026-46561.md): pyLoad: SSRF via HTTP Redirect Bypass in parse\_urls API (CVSS 5.0) - [CVE-2026-44226](https://cve.now/CVE-2026-44226.md): pyLoad: Unauthenticated traceback disclosure via global exception handler in WebUI (CVSS 5.3) - [CVE-2026-42315](https://cve.now/CVE-2026-42315.md): pyLoad: Path Traversal via Package Folder Name in set\_package\_data (CVSS 8.1) - [CVE-2026-42314](https://cve.now/CVE-2026-42314.md): pyLoad: Path Traversal via Package Folder Name (CVSS 6.5) - [CVE-2026-42312](https://cve.now/CVE-2026-42312.md): pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification (CVSS 6.8) - [CVE-2026-42313](https://cve.now/CVE-2026-42313.md): pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy (CVSS 8.3) - [CVE-2026-41133](https://cve.now/CVE-2026-41133.md): pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass) (CVSS 8.8) - [CVE-2026-40594](https://cve.now/CVE-2026-40594.md): pyLoad: Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition) (CVSS 4.8) - [CVE-2026-40071](https://cve.now/CVE-2026-40071.md): pyLoad WebUI JSON permission mismatch lets ADD/DELETE users invoke MODIFY-only actions (CVSS 5.4) - [CVE-2026-35592](https://cve.now/CVE-2026-35592.md): pyLoad has an Incomplete Tar Path Traversal Fix in UnTar.\_safe\_extractall via os.path.commonprefix Bypass (CVSS 5.3) - [CVE-2026-35586](https://cve.now/CVE-2026-35586.md): Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ng (CVSS 6.8) - [CVE-2026-35464](https://cve.now/CVE-2026-35464.md): pyLoad has an incomplete fix for CVE-2026-33509: unprotected storage\_folder enables arbitrary file write to Flask session store and code execution (CVSS 7.5) - [CVE-2026-35463](https://cve.now/CVE-2026-35463.md): pyLoad has Improper Neutralization of Special Elements used in an OS Command (CVSS 8.8) - [CVE-2026-35459](https://cve.now/CVE-2026-35459.md): pyLoad has SSRF fix bypass via HTTP redirect (CVSS 9.3) - [CVE-2026-35187](https://cve.now/CVE-2026-35187.md): pyLoad has SSRF in parse\_urls API endpoint via unvalidated URL parameter (CVSS 7.7) - [CVE-2026-33992](https://cve.now/CVE-2026-33992.md): pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration (CVSS 9.3) - [CVE-2026-33511](https://cve.now/CVE-2026-33511.md): pyload-ng: Authentication Bypass via Host Header Injection in ClickNLoad (CVSS 8.8) - [CVE-2026-33509](https://cve.now/CVE-2026-33509.md): pyload-ng: SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration (CVSS 7.5) - [CVE-2026-33314](https://cve.now/CVE-2026-33314.md): pyload-ng: Improper Authentication and Origin Validation Error (CVSS 6.5) - [CVE-2026-32808](https://cve.now/CVE-2026-32808.md): pyLoad: Arbitrary File Deletion via Path Traversal during Encrypted 7z Password Verification (CVSS 8.1) - [CVE-2026-29778](https://cve.now/CVE-2026-29778.md): pyLoad: Arbitrary File Write via Path Traversal in edit\_package() (CVSS 7.1) - [CVE-2025-61773](https://cve.now/CVE-2025-61773.md): pyLoad CNL and captcha handlers allow code Injection via unsanitized parameters (CVSS 8.1) - [CVE-2025-57751](https://cve.now/CVE-2025-57751.md): Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs (CVSS 7.7) - [CVE-2025-55156](https://cve.now/CVE-2025-55156.md): PyLoad vulnerable to SQL Injection via API /json/add\_package in add\_links parameter (CVSS 7.8) - [CVE-2025-54802](https://cve.now/CVE-2025-54802.md): pyLoad CNL Blueprint is vulnerable to Path Traversal through \`dlc\_path\` leading to Remote Code Execution (RCE) (CVSS 9.8) - [CVE-2025-54140](https://cve.now/CVE-2025-54140.md): pyLoad has Path Traversal Vulnerability in json/upload Endpoint that allows Arbitrary File Write (CVSS 7.5) - [CVE-2025-53890](https://cve.now/CVE-2025-53890.md): pyLoad vulnerable to remote code execution through js2py onCaptchaResult (CVSS 9.8) - [CVE-2025-7346](https://cve.now/CVE-2025-7346.md): Any unauthenticated attacker can bypass the localhost restrictions posed by the application and utilize this to create arbitrary packages (CVSS 8.7) - [CVE-2024-1240](https://cve.now/CVE-2024-1240.md): Open Redirection in pyload/pyload (CVSS 4.6) - [CVE-2024-47821](https://cve.now/CVE-2024-47821.md): pyLoad vulnerable to remote code execution by download to /.pyload/scripts using /flashgot API (CVSS 9.1) - [CVE-2024-32880](https://cve.now/CVE-2024-32880.md): pyLoad allows upload to arbitrary folder lead to RCE (CVSS 9.1) - [CVE-2024-24808](https://cve.now/CVE-2024-24808.md): pyLoad open redirect vulnerability due to improper validation of the is\_safe\_url function (CVSS 4.7) - [CVE-2024-22416](https://cve.now/CVE-2024-22416.md): Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation (CVSS 9.7) - [CVE-2024-21644](https://cve.now/CVE-2024-21644.md): pyLoad unauthenticated flask configuration leakage (CVSS 7.5) - [CVE-2024-21645](https://cve.now/CVE-2024-21645.md): pyLoad Log Injection (CVSS 5.3) - [CVE-2023-0509](https://cve.now/CVE-2023-0509.md): Improper Certificate Validation in pyload/pyload (CVSS 7.4) - [CVE-2023-0488](https://cve.now/CVE-2023-0488.md): Cross-site Scripting (XSS) - Stored in pyload/pyload (CVSS 9.6) - [CVE-2023-0435](https://cve.now/CVE-2023-0435.md): Excessive Attack Surface in pyload/pyload (CVSS 4.0) - [CVE-2023-0434](https://cve.now/CVE-2023-0434.md): Improper Input Validation in pyload/pyload (CVSS 5.4) - [CVE-2023-0297](https://cve.now/CVE-2023-0297.md): Code Injection in pyload/pyload (CVSS 9.8) - [CVE-2023-0227](https://cve.now/CVE-2023-0227.md): Insufficient Session Expiration in pyload/pyload (CVSS 8.3) - [CVE-2023-0057](https://cve.now/CVE-2023-0057.md): Improper Restriction of Rendered UI Layers or Frames in pyload/pyload (CVSS 3.1) - [CVE-2023-0055](https://cve.now/CVE-2023-0055.md): Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in pyload/pyload (CVSS 3.1) --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/vendors/pyload Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.