Vulnerabilities

TI-2026-70042 CVE-2026-75597 · GHSA-j92p-c242-7hfx

Missing authentication in pyLoad exposes templates and error details

MEDIUM 63

pyLoad is a free and open-source download manager written in Python.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00296 Published 2026-10-09 Fixed in 0.5.0b3.dev101 CWE-209

TI-2026-70045 CVE-2026-48484 · GHSA-vq8p-m3wm-gv5f

pyLoad API uploads can exhaust memory and terminate the process

MEDIUM 62

pyLoad is a free and open-source download manager written in Python.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00371 Published 2026-10-09 Fixed in 0.5.0b3.dev101 CWE-20

TI-2026-36243 CVE-2026-48987 · GHSA-c2f9-4mc8-j656

pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager

MEDIUM 62

pyLoad is a free and open-source download manager written in Python.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00436 Published 2026-09-15 Fixed in 0.5.0b3.dev101 CWE-400

TI-2026-36013 CVE-2026-48737 · GHSA-m5x5-28jr-gpjj

pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs

MEDIUM 56

pyLoad is a free and open-source download manager written in Python.

CVSS 3.1MEDIUM 4.9 Network Low privileges No interaction EPSS 0.00289 Published 2026-09-15 Fixed in 0.5.0b3.dev101 CWE-918

TI-2026-33106 CVE-2026-45306 · GHSA-w727-595x-pc3r

pyLoad: Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory

MEDIUM 62

pyLoad is a free and open-source download manager written in Python.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00234 Published 2026-05-28 Fixed in 0.5.0b3.dev100 CWE-706

TI-2026-33142 CVE-2026-45348 · GHSA-fcjq-435v-jx94

pyLoad: Stored XSS in Downloads view via unsanitized link URL in packages.js template literal

LOW 39

pyLoad is a free and open-source download manager written in Python.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00199 Published 2026-05-28 Fixed in 0.5.0b3.dev100 CWE-79

TI-2026-34239 CVE-2026-46561 · GHSA-8rp3-xc6w-5qp5

pyLoad: SSRF via HTTP Redirect Bypass in parse_urls API

MEDIUM 56

pyLoad is a free and open-source download manager written in Python.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00176 Published 2026-05-28 Fixed in 0.5.0b3.dev100 CWE-918

TI-2026-32205 CVE-2026-44226 · GHSA-c3gc-9pf2-84gg

pyLoad: Unauthenticated traceback disclosure via global exception handler in WebUI

MEDIUM 63

pyLoad is a free and open-source download manager written in Python.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00336 Published 2026-05-11 Fixed in 0.5.0b3.dev100 CWE-209

TI-2026-30623 CVE-2026-42315 · GHSA-838g-gr43-qqg9

pyLoad: Path Traversal via Package Folder Name in set_package_data

HIGH 68

pyLoad is a free and open-source download manager written in Python.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00395 Published 2026-05-11 Fixed in 0.5.0b3.dev100 CWE-22

TI-2026-30622 CVE-2026-42314 · GHSA-97r3-5w84-r4q8

pyLoad: Path Traversal via Package Folder Name

MEDIUM 62

pyLoad is a free and open-source download manager written in Python.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00342 Published 2026-05-11 Fixed in 0.5.0b3.dev100 CWE-22

TI-2026-30620 CVE-2026-42312 · GHSA-ccxc-x975-4hh9

pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification

HIGH 65

pyLoad is a free and open-source download manager written in Python.

CVSS 3.1MEDIUM 6.8 Network Low privileges No interaction EPSS 0.00174 Published 2026-05-11 Fixed in 0.5.0b3.dev100 CWE-295

TI-2026-30621 CVE-2026-42313 · GHSA-pg67-9wjv-mr85

pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy

HIGH 71

pyLoad is a free and open-source download manager written in Python.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00396 Published 2026-05-11 Fixed in 0.5.0b3.dev100 CWE-441

TI-2026-29761 CVE-2026-41133 · GHSA-66hx-chf7-3332

pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)

HIGH 73

pyLoad is a free and open-source download manager written in Python.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00325 Published 2026-04-21 No fix listed CWE-613

TI-2026-29330 CVE-2026-40594 · GHSA-mp82-fmj6-f22v

pyLoad: Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)

MEDIUM 55

pyLoad is a free and open-source download manager written in Python.

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00171 Published 2026-04-21 Fixed in 0.5.0b3.dev98 CWE-346

TI-2026-28902 CVE-2026-40071 · GHSA-rfgh-63mg-8pwm

pyLoad WebUI JSON permission mismatch lets ADD/DELETE users invoke MODIFY-only actions

MEDIUM 58

pyLoad is a free and open-source download manager written in Python.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00227 Published 2026-04-09 Fixed in 0.5.0b3.dev97 CWE-863

TI-2026-27695 CVE-2026-35592 · GHSA-mvwx-582f-56r7

pyLoad has an Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix Bypass

MEDIUM 62

pyLoad is a free and open-source download manager written in Python.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00265 Published 2026-04-07 Fixed in 0.5.0b3.dev97 CWE-22

TI-2026-27689 CVE-2026-35586 · GHSA-ppvx-rwh9-7rj7

Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ng

HIGH 65

pyLoad is a free and open-source download manager written in Python.

CVSS 3.1MEDIUM 6.8 Network Low privileges No interaction EPSS 0.00147 Published 2026-04-07 Fixed in 0.5.0b3.dev97 CWE-863

TI-2026-27594 CVE-2026-35464 · GHSA-4744-96p5-mp2j

Deserialization of untrusted data in pyload

HIGH 68

pyLoad is a free and open-source download manager written in Python.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00548 Published 2026-04-07 No fix listed CWE-502

TI-2026-27593 CVE-2026-35463 · GHSA-w48f-wwwf-f5fr

pyLoad has Improper Neutralization of Special Elements used in an OS Command

HIGH 73

pyLoad is a free and open-source download manager written in Python.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00847 Published 2026-04-07 No fix listed CWE-78

TI-2026-27589 CVE-2026-35459 · GHSA-7gvf-3w72-p2pg

pyLoad has SSRF fix bypass via HTTP redirect

HIGH 81

pyLoad is a free and open-source download manager written in Python.

CVSS 4.0CRITICAL 9.3 Network Low privileges No interaction EPSS 0.00284 Published 2026-04-06 No fix listed CWE-918

TI-2026-27341 CVE-2026-35187 · GHSA-2wvg-62qm-gj33

pyLoad has SSRF in parse_urls API endpoint via unvalidated URL parameter

HIGH 67

pyLoad is a free and open-source download manager written in Python.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00279 Published 2026-04-06 No fix listed CWE-918

TI-2026-26332 CVE-2026-33992 · GHSA-m74m-f7cr-432x

pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration

HIGH 81

pyLoad is a free and open-source download manager written in Python.

CVSS 4.0CRITICAL 9.3 Network Low privileges No interaction EPSS 0.00404 Published 2026-03-27 Fixed in 0.5.0b3.dev97 CWE-918

TI-2026-25907 CVE-2026-33511

pyload-ng: Authentication Bypass via Host Header Injection in ClickNLoad

HIGH 77

pyLoad is a free and open-source download manager written in Python.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00438 Published 2026-03-24 Fixed in 0.5.0b3.dev97 CWE-639

TI-2026-25905 CVE-2026-33509 · GHSA-r7mc-x6x7-cqxx

pyload-ng: SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration

HIGH 73

pyLoad is a free and open-source download manager written in Python.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0055 Published 2026-03-24 Fixed in 0.5.0b3.dev97 CWE-269

TI-2026-25725 CVE-2026-33314 · GHSA-q485-cg9q-xq2r

pyload-ng: Improper Authentication and Origin Validation Error

HIGH 68

pyLoad is a free and open-source download manager written in Python.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.0019 Published 2026-03-24 Fixed in 0.5.0b3.dev97 CWE-287

Vulnerabilities

Filters