Pyload-ng Project

Records20All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical3CVSS 9.0–10.0

CVSS high9CVSS 7.0–8.9

Exploited now

Pyload-ng Project records in CISA KEV

No Pyload-ng Project vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Pyload-ng 20 records HIGH

Records

20 records in Pyload-ng · all components

TI-2025-34556 CVE-2025-54802 · GHSA-48rp-jc79-2264

pyLoad CNL Blueprint is vulnerable to Path Traversal through `dlc_path` leading to Remote Code Execution (RCE)

HIGH 82

pyLoad is the free and open-source Download Manager written in pure Python.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0139 Published 2025-08-05 Fixed in 0.5.0b3.dev90 CWE-22

TI-2026-27589 CVE-2026-35459 · GHSA-7gvf-3w72-p2pg

pyLoad has SSRF fix bypass via HTTP redirect

HIGH 81

pyLoad is a free and open-source download manager written in Python.

CVSS 4.0CRITICAL 9.3 Network Low privileges No interaction EPSS 0.00284 Published 2026-04-06 No fix listed CWE-918

TI-2026-25907 CVE-2026-33511

pyload-ng: Authentication Bypass via Host Header Injection in ClickNLoad

HIGH 77

pyLoad is a free and open-source download manager written in Python.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00438 Published 2026-03-24 Fixed in 0.5.0b3.dev97 CWE-639

TI-2026-27593 CVE-2026-35463 · GHSA-w48f-wwwf-f5fr

pyLoad has Improper Neutralization of Special Elements used in an OS Command

HIGH 73

pyLoad is a free and open-source download manager written in Python.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00847 Published 2026-04-07 No fix listed CWE-78

TI-2026-25905 CVE-2026-33509 · GHSA-r7mc-x6x7-cqxx

pyload-ng: SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration

HIGH 73

pyLoad is a free and open-source download manager written in Python.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0055 Published 2026-03-24 Fixed in 0.5.0b3.dev97 CWE-269

TI-2026-30621 CVE-2026-42313 · GHSA-pg67-9wjv-mr85

pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy

HIGH 71

pyLoad is a free and open-source download manager written in Python.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00396 Published 2026-05-11 Fixed in 0.5.0b3.dev100 CWE-441

TI-2026-30623 CVE-2026-42315 · GHSA-838g-gr43-qqg9

pyLoad: Path Traversal via Package Folder Name in set_package_data

HIGH 68

pyLoad is a free and open-source download manager written in Python.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00395 Published 2026-05-11 Fixed in 0.5.0b3.dev100 CWE-22

TI-2026-25725 CVE-2026-33314 · GHSA-q485-cg9q-xq2r

pyload-ng: Improper Authentication and Origin Validation Error

HIGH 68

pyLoad is a free and open-source download manager written in Python.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.0019 Published 2026-03-24 Fixed in 0.5.0b3.dev97 CWE-287

TI-2026-25278 CVE-2026-32808

pyLoad: Arbitrary File Deletion via Path Traversal during Encrypted 7z Password Verification

HIGH 68

pyLoad is a free and open-source download manager written in Python.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.0034 Published 2026-03-20 Fixed in 0.5.0b3.dev97 CWE-22

TI-2023-00483 CVE-2023-0509 · GHSA-8v53-23mx-hcf9

Improper Certificate Validation in pyload/pyload

HIGH 68

Improper Certificate Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev44.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00545 Published 2023-01-26 Fixed in 0.5.0b3.dev44 CWE-295

TI-2026-27341 CVE-2026-35187 · GHSA-2wvg-62qm-gj33

pyLoad has SSRF in parse_urls API endpoint via unvalidated URL parameter

HIGH 67

pyLoad is a free and open-source download manager written in Python.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00279 Published 2026-04-06 No fix listed CWE-918

TI-2026-30620 CVE-2026-42312 · GHSA-ccxc-x975-4hh9

pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification

HIGH 65

pyLoad is a free and open-source download manager written in Python.

CVSS 3.1MEDIUM 6.8 Network Low privileges No interaction EPSS 0.00174 Published 2026-05-11 Fixed in 0.5.0b3.dev100 CWE-295

TI-2026-27689 CVE-2026-35586 · GHSA-ppvx-rwh9-7rj7

Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ng

HIGH 65

pyLoad is a free and open-source download manager written in Python.

CVSS 3.1MEDIUM 6.8 Network Low privileges No interaction EPSS 0.00147 Published 2026-04-07 Fixed in 0.5.0b3.dev97 CWE-863

TI-2026-23364 CVE-2026-29778 · GHSA-6px9-j4qr-xfjw

pyLoad: Arbitrary File Write via Path Traversal in edit_package()

MEDIUM 64

pyLoad is a free and open-source download manager written in Python.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00571 Published 2026-03-07 Fixed in 0.5.0b3.dev97 CWE-23

TI-2026-30622 CVE-2026-42314 · GHSA-97r3-5w84-r4q8

pyLoad: Path Traversal via Package Folder Name

MEDIUM 62

pyLoad is a free and open-source download manager written in Python.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00342 Published 2026-05-11 Fixed in 0.5.0b3.dev100 CWE-22

TI-2026-27695 CVE-2026-35592 · GHSA-mvwx-582f-56r7

pyLoad has an Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix Bypass

MEDIUM 62

pyLoad is a free and open-source download manager written in Python.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00265 Published 2026-04-07 Fixed in 0.5.0b3.dev97 CWE-22

TI-2023-00462 CVE-2023-0488 · GHSA-wcm6-wv95-7jw6

Cross-site Scripting (XSS) - Stored in pyload/pyload

MEDIUM 60

Cross-site Scripting (XSS) - Stored in GitHub repository pyload/pyload prior to 0.5.0b3.dev42.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00852 Published 2023-01-26 Fixed in 0.5.0b3.dev42 CWE-79

TI-2023-00053 CVE-2023-0057 · GHSA-h8r9-467r-vjjf

Improper Restriction of Rendered UI Layers or Frames in pyload/pyload

MEDIUM 60

Improper Restriction of Rendered UI Layers or Frames in GitHub repository pyload/pyload prior to 0.5.0b3.dev33.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.005 Published 2023-01-05 Fixed in 0.5.0b3.dev33 CWE-1021

TI-2026-29330 CVE-2026-40594 · GHSA-mp82-fmj6-f22v

pyLoad: Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)

MEDIUM 55

pyLoad is a free and open-source download manager written in Python.

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00171 Published 2026-04-21 Fixed in 0.5.0b3.dev98 CWE-346

TI-2024-14989 CVE-2024-22416 · GHSA-pgpj-v85q-h5fm

Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation

MEDIUM 49

pyLoad is a free and open-source Download Manager written in pure Python.

CVSS 3.1CRITICAL 9.7 Network No auth User interaction EPSS 0.00948 Published 2024-01-17 Fixed in 0.5.0b3.dev78 CWE-352

Open these records in search →

Critical	3
High	9
Medium	8
Low	0
No CVSS	0