Pyload-ng_project Pyload-ng
20 CVEs affecting Pyload-ng_project Pyload-ng. Latest disclosed: 2026-05-11. Critical: 4, High: 8.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-33511 | Critical | 9.8 | 2026-03-24 | pyLoad is a free and open-source download manager written in Python. From version 0.4.20 to before version 0.5.0b3.dev97, the local_check decorator in pyLoad's… |
CVE-2025-54802 | Critical | 9.8 | 2025-08-05 | pyLoad is the free and open-source Download Manager written in pure Python. In versions 0.5.0b3.dev89 and below, there is an opportunity for path traversal in… |
CVE-2024-22416 | Critical | 9.6 | 2024-01-18 | pyLoad is a free and open-source Download Manager written in pure Python. The `pyload` API allows any API call to be made using GET requests. Since the session… |
CVE-2026-35459 | Critical | 9.1 | 2026-04-06 | pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, pyLoad has a server-side request forgery (SSRF) vulnerabilit… |
CVE-2026-35463 | High | 8.8 | 2026-04-07 | pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the ADMIN_ONLY_OPTIONS protection mechanism restricts securi… |
CVE-2026-42313 | High | 8.3 | 2026-05-11 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_value() API method (@permission(Perms.SETTINGS)) i… |
CVE-2026-42315 | High | 8.1 | 2026-05-11 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, when passing a folder name in the set_package_data() API function… |
CVE-2026-32808 | High | 8.1 | 2026-03-20 | pyLoad is a free and open-source download manager written in Python. Versions before 0.5.0b3.dev97 are vulnerable to path traversal during password verificatio… |
CVE-2026-35187 | High | 7.7 | 2026-04-06 | pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the parse_urls API function in src/pyload/core/api/__init__… |
CVE-2026-33509 | High | 7.5 | 2026-03-24 | pyLoad is a free and open-source download manager written in Python. From version 0.4.0 to before version 0.5.0b3.dev97, the set_config_value() API endpoint al… |
CVE-2023-0509 | High | 7.4 | 2023-01-26 | Improper Certificate Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev44. |
CVE-2026-29778 | High | 7.1 | 2026-03-07 | pyLoad is a free and open-source download manager written in Python. From version 0.5.0b3.dev13 to 0.5.0b3.dev96, the edit_package() function implements insuff… |
CVE-2026-42312 | Medium | 6.8 | 2026-05-11 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_value() API method (@permission(Perms.SETTINGS)) i… |
CVE-2026-35586 | Medium | 6.8 | 2026-04-07 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the ADMIN_ONLY_CORE_OPTIONS authorization set in set_config_value(… |
CVE-2026-42314 | Medium | 6.5 | 2026-05-11 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, package folder names are sanitized using insufficient string repl… |
CVE-2026-33314 | Medium | 6.5 | 2026-03-24 | pyLoad is a free and open-source download manager written in Python. Prior to version 0.5.0b3.dev97, a Host Header Spoofing vulnerability in the @local_check d… |
CVE-2023-0057 | Medium | 6.1 | 2023-01-05 | Improper Restriction of Rendered UI Layers or Frames in GitHub repository pyload/pyload prior to 0.5.0b3.dev33. |
CVE-2023-0488 | Medium | 5.4 | 2023-01-26 | Cross-site Scripting (XSS) - Stored in GitHub repository pyload/pyload prior to 0.5.0b3.dev42. |
CVE-2026-35592 | Medium | 5.3 | 2026-04-07 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the _safe_extractall() function in src/pyload/plugins/extractors/U… |
CVE-2026-40594 | Medium | 4.8 | 2026-04-21 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev98, the set_session_cookie_secure before_request handler in src/pyload… |