CVE-2026-46561 | Medium | 5.0 | 2026-05-28 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the PREREQFUNCTION-based private IP check was not applied to HTTP… |
CVE-2026-45348 | High | 8.7 | 2026-05-28 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the packages.js template at src/pyload/webui/app/themes/modern/te… |
CVE-2026-45306 | Medium | 6.5 | 2026-05-28 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the fix for CVE-2026-33509 prevents setting storage_folder inside… |
CVE-2026-44226 | Medium | 5.3 | 2026-05-11 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, pyload-ng WebUI returns full Python traceback details to clients… |
CVE-2026-42315 | High | 8.1 | 2026-05-11 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, when passing a folder name in the set_package_data() API function… |
CVE-2026-42314 | Medium | 6.5 | 2026-05-11 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, package folder names are sanitized using insufficient string repl… |
CVE-2026-42313 | High | 8.3 | 2026-05-11 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_value() API method (@permission(Perms.SETTINGS)) i… |
CVE-2026-42312 | Medium | 6.8 | 2026-05-11 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_value() API method (@permission(Perms.SETTINGS)) i… |
CVE-2026-41133 | High | 8.8 | 2026-04-22 | pyLoad is a free and open-source download manager written in Python. Versions up to and including 0.5.0b3.dev97 cache `role` and `permission` in the session at… |
CVE-2026-40594 | Medium | 4.8 | 2026-04-21 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev98, the set_session_cookie_secure before_request handler in src/pyload… |
CVE-2026-40071 | Medium | 5.4 | 2026-04-09 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the /json/package_order, /json/link_order, and /json/abort_link We… |
CVE-2026-35592 | Medium | 5.3 | 2026-04-07 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the _safe_extractall() function in src/pyload/plugins/extractors/U… |
CVE-2026-35586 | Medium | 6.8 | 2026-04-07 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the ADMIN_ONLY_CORE_OPTIONS authorization set in set_config_value(… |
CVE-2026-35464 | High | 7.5 | 2026-04-07 | pyLoad is a free and open-source download manager written in Python. The fix for CVE-2026-33509 added an ADMIN_ONLY_OPTIONS set to block non-admin users from m… |
CVE-2026-35463 | High | 8.8 | 2026-04-07 | pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the ADMIN_ONLY_OPTIONS protection mechanism restricts securi… |
CVE-2026-35459 | Critical | 9.1 | 2026-04-06 | pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, pyLoad has a server-side request forgery (SSRF) vulnerabilit… |
CVE-2026-35187 | High | 7.7 | 2026-04-06 | pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the parse_urls API function in src/pyload/core/api/__init__… |
CVE-2026-33992 | Medium | 6.5 | 2026-03-27 | pyLoad is a free and open-source download manager written in Python. Prior to version 0.5.0b3.dev97, PyLoad's download engine accepts arbitrary URLs without va… |
CVE-2026-33511 | Critical | 9.8 | 2026-03-24 | pyLoad is a free and open-source download manager written in Python. From version 0.4.20 to before version 0.5.0b3.dev97, the local_check decorator in pyLoad's… |
CVE-2026-33509 | High | 7.5 | 2026-03-24 | pyLoad is a free and open-source download manager written in Python. From version 0.4.0 to before version 0.5.0b3.dev97, the set_config_value() API endpoint al… |
CVE-2026-33314 | Medium | 6.5 | 2026-03-24 | pyLoad is a free and open-source download manager written in Python. Prior to version 0.5.0b3.dev97, a Host Header Spoofing vulnerability in the @local_check d… |
CVE-2026-32808 | High | 8.1 | 2026-03-20 | pyLoad is a free and open-source download manager written in Python. Versions before 0.5.0b3.dev97 are vulnerable to path traversal during password verificatio… |
CVE-2026-29778 | High | 7.1 | 2026-03-07 | pyLoad is a free and open-source download manager written in Python. From version 0.5.0b3.dev13 to 0.5.0b3.dev96, the edit_package() function implements insuff… |
CVE-2025-61773 | High | 8.1 | 2025-10-09 | pyLoad is a free and open-source download manager written in Python. In versions prior to 0.5.0b3.dev91, pyLoad web interface contained insufficient input vali… |
CVE-2025-57751 | | | 2025-08-21 | pyLoad is the free and open-source Download Manager written in pure Python. The jk parameter is received in pyLoad CNL Blueprint. Due to the lack of jk paramet… |
CVE-2025-55156 | | | 2025-08-11 | pyLoad is the free and open-source Download Manager written in pure Python. Prior to version 0.5.0b3.dev91, the parameter add_links in API /json/add_package is… |
CVE-2025-54802 | Critical | 9.8 | 2025-08-05 | pyLoad is the free and open-source Download Manager written in pure Python. In versions 0.5.0b3.dev89 and below, there is an opportunity for path traversal in… |
CVE-2025-54140 | High | 7.5 | 2025-07-22 | pyLoad is a free and open-source Download Manager written in pure Python. In version 0.5.0b3.dev89, an authenticated path traversal vulnerability exists in the… |
CVE-2025-53890 | Critical | 9.8 | 2025-07-15 | pyload is an open-source Download Manager written in pure Python. An unsafe JavaScript evaluation vulnerability in pyLoad’s CAPTCHA processing code allows unau… |
CVE-2025-7346 | | | 2025-07-08 | Any unauthenticated attacker can bypass the localhost
restrictions posed by the application and utilize this to create
arbitrary packages |
CVE-2024-1240 | Medium | 6.1 | 2024-11-15 | An open redirection vulnerability exists in pyload/pyload version 0.5.0. The vulnerability is due to improper handling of the 'next' parameter in the login fun… |
CVE-2024-47821 | Critical | 9.1 | 2024-10-25 | pyLoad is a free and open-source Download Manager. The folder `/.pyload/scripts` has scripts which are run when certain actions are completed, for e.g. a downl… |
CVE-2024-32880 | Critical | 9.1 | 2024-04-26 | pyload is an open-source Download Manager written in pure Python. An authenticated user can change the download folder and upload a crafted template to the spe… |
CVE-2024-24808 | Medium | 4.7 | 2024-02-06 | pyLoad is an open-source Download Manager written in pure Python. There is an open redirect vulnerability due to incorrect validation of input values when redi… |
CVE-2024-22416 | Critical | 9.6 | 2024-01-18 | pyLoad is a free and open-source Download Manager written in pure Python. The `pyload` API allows any API call to be made using GET requests. Since the session… |
CVE-2023-47890 | High | 8.8 | 2024-01-08 | pyLoad 0.5.0 is vulnerable to Unrestricted File Upload. |
CVE-2024-21645 | Medium | 5.3 | 2024-01-08 | pyLoad is the free and open-source Download Manager written in pure Python. A log injection vulnerability was identified in `pyload` allowing any unauthenticat… |
CVE-2024-21644 | High | 7.5 | 2024-01-08 | pyLoad is the free and open-source Download Manager written in pure Python. Any unauthenticated user can browse to a specific URL to expose the Flask config, i… |
CVE-2023-0509 | High | 7.4 | 2023-01-26 | Improper Certificate Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev44. |
CVE-2023-0488 | Medium | 5.4 | 2023-01-26 | Cross-site Scripting (XSS) - Stored in GitHub repository pyload/pyload prior to 0.5.0b3.dev42. |
CVE-2023-0435 | Critical | 9.8 | 2023-01-22 | Excessive Attack Surface in GitHub repository pyload/pyload prior to 0.5.0b3.dev41. |
CVE-2023-0434 | High | 7.5 | 2023-01-22 | Improper Input Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev40. |
CVE-2023-0297 | Critical | 9.8 | 2023-01-14 | Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31. |
CVE-2023-0227 | Medium | 6.5 | 2023-01-12 | Insufficient Session Expiration in GitHub repository pyload/pyload prior to 0.5.0b3.dev36. |
CVE-2023-0057 | Medium | 6.1 | 2023-01-05 | Improper Restriction of Rendered UI Layers or Frames in GitHub repository pyload/pyload prior to 0.5.0b3.dev33. |
CVE-2023-0055 | Medium | 5.3 | 2023-01-04 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository pyload/pyload prior to 0.5.0b3.dev32. |