MEDIUM6.1PyPI
PYSEC-2024-123· CVE-2024-1240Modified: 10/9/2025
package
PyPI/pyload-ng
pkg:pypi/pyload-ng
HIGH8.8PyPI
PYSEC-2024-17· CVE-2024-22416, GHSA-pgpj-v85q-h5fmModified: 1/29/2024
LOW2.3PyPI
PYSEC-2024-302· CVE-2024-47821, GHSA-w7hq-f2pj-c53gModified: 5/21/2026
MEDIUM6.5PyPI
PYSEC-2026-121· CVE-2026-29778, GHSA-6px9-j4qr-xfjwModified: 5/20/2026
MEDIUM6.5PyPI
PYSEC-2026-122· CVE-2026-33314, GHSA-q485-cg9q-xq2rModified: 5/20/2026
MEDIUM6.8PyPI
PYSEC-2026-123· CVE-2026-35586, GHSA-ppvx-rwh9-7rj7Modified: 5/20/2026
MEDIUM6.5PyPI
PYSEC-2026-124· CVE-2026-35592, GHSA-mvwx-582f-56r7Modified: 5/20/2026
MEDIUM4.8PyPI
PYSEC-2026-125· CVE-2026-40594, GHSA-mp82-fmj6-f22vModified: 5/20/2026
MEDIUM6.8PyPI
PYSEC-2026-126· CVE-2026-42312, GHSA-ccxc-x975-4hh9Modified: 5/20/2026
HIGH8.3PyPI
PYSEC-2026-127· CVE-2026-42313, GHSA-pg67-9wjv-mr85Modified: 5/20/2026
MEDIUM6.5PyPI
PYSEC-2026-128· CVE-2026-42314, GHSA-97r3-5w84-r4q8Modified: 5/20/2026
MEDIUM6.5PyPI
PYSEC-2026-129· CVE-2026-42315, GHSA-838g-gr43-qqg9Modified: 5/20/2026
—PyPI
PYSEC-2026-1815· CVE-2025-57751, GHSA-9gjj-6gj7-c4wjDenial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs
Modified: 7/7/2026
HIGH8.1PyPI
PYSEC-2026-1816· CVE-2025-61773, GHSA-cjjf-27cc-pvmvpyLoad CNL and captcha handlers allow Code Injection via unsanitized parameters
Modified: 7/7/2026
MEDIUM6.1PyPI
PYSEC-2026-1817· CVE-2024-24808, GHSA-g3cm-qg2v-2hj5pyLoad open redirect vulnerability due to improper validation of the is_safe_url function
Modified: 7/7/2026
MEDIUM5.3PyPI
PYSEC-2026-1818· CVE-2024-21645, GHSA-ghmw-rwh8-6qmrpyload Log Injection vulnerability
Modified: 7/7/2026
HIGH7.6PyPI
PYSEC-2026-1819· CVE-2023-47890, GHSA-h73m-pcfw-25h2Download to arbitrary folder can lead to RCE
Modified: 7/7/2026
HIGH7.5PyPI
PYSEC-2026-1820· CVE-2024-21644, GHSA-mqpq-2p68-46fvpyload Unauthenticated Flask Configuration Leakage vulnerability
Modified: 7/7/2026
—PyPI
PYSEC-2026-1821· CVE-2025-55156, GHSA-pwh4-6r3m-j2rfPyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameter
Modified: 7/7/2026
HIGH7.5PyPI
PYSEC-2026-1822· CVE-2025-7346, GHSA-x698-5hjm-w2m5pyLoad is vulnerable to attacks that bypass localhost restrictions, enabling the creation of arbitrary packages
Modified: 7/7/2026
HIGH7.5PyPI
PYSEC-2026-1823· CVE-2025-54140, GHSA-xqpg-92fq-grfg`pyLoad` has Path Traversal Vulnerability in `json/upload` Endpoint that allows Arbitrary File Write
Modified: 7/7/2026
HIGH8.8PyPI
PYSEC-2026-2267· CVE-2026-35463, GHSA-w48f-wwwf-f5frModified: 7/13/2026
HIGH7.7PyPI
PYSEC-2026-2988· CVE-2026-35187, GHSA-2wvg-62qm-gj33pyLoad: SSRF in parse_urls API endpoint via unvalidated URL parameter
Modified: 7/13/2026
HIGH7.5PyPI
PYSEC-2026-2989· CVE-2026-35464, GHSA-4744-96p5-mp2jpyLoad: Unprotected storage_folder enables arbitrary file write to Flask session store and code execution (Incomplete fix for CVE-2026-33509)
Modified: 7/13/2026
HIGH8.8PyPI
PYSEC-2026-2990· CVE-2026-41133, GHSA-66hx-chf7-3332pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)
Modified: 7/13/2026
MEDIUM5.0PyPI
PYSEC-2026-2991· CVE-2026-46561, GHSA-8rp3-xc6w-5qp5pyload-ng: SSRF via HTTP Redirect Bypass in parse_urls API
Modified: 7/13/2026
MEDIUM6.5PyPI
PYSEC-2026-2992· CVE-2026-48987, GHSA-c2f9-4mc8-j656pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager
Modified: 7/13/2026
MEDIUM5.3PyPI
PYSEC-2026-2993· CVE-2026-44226, GHSA-c3gc-9pf2-84ggPyLoad vulnerable to unauthenticated traceback disclosure via global exception handler in WebUI
Modified: 7/13/2026
HIGH8.7PyPI
PYSEC-2026-2994· CVE-2026-45348, GHSA-fcjq-435v-jx94pyLoad is vulnerable to stored XSS in Downloads view via unsanitized link URL in packages.js template literal
Modified: 7/13/2026
MEDIUM4.9PyPI
PYSEC-2026-2995· CVE-2026-48737, GHSA-m5x5-28jr-gpjjpyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs
Modified: 7/13/2026
HIGH7.5PyPI
PYSEC-2026-2996· CVE-2026-33509, GHSA-r7mc-x6x7-cqxxpyLoad SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration
Modified: 7/13/2026
MEDIUM5.4PyPI
PYSEC-2026-2997· CVE-2026-40071, GHSA-rfgh-63mg-8pwmpyload-ng has a WebUI JSON permission mismatch that lets ADD/DELETE users invoke MODIFY-only actions
Modified: 7/13/2026
MEDIUM6.5PyPI
PYSEC-2026-2998· CVE-2026-45306, GHSA-w727-595x-pc3rpyLoad Has Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory in pyLoad
Modified: 7/13/2026
CRITICAL9.1PyPI
PYSEC-2026-492· CVE-2024-32880, GHSA-3f7w-p8vr-4v5fpyLoad allows upload to arbitrary folder lead to RCE
Modified: 7/9/2026
CRITICAL9.8PyPI
PYSEC-2026-493· CVE-2025-54802, GHSA-48rp-jc79-2264pyLoad CNL Blueprint allows Path Traversal through `dlc_path` which leads to Remote Code Execution (RCE)
Modified: 7/13/2026
CRITICAL9.8PyPI
PYSEC-2026-494· CVE-2023-0435, GHSA-6jmx-pv77-wm5wExcessive Attack Surface in pyload-ng
Modified: 7/1/2026
—PyPI
PYSEC-2026-495· CVE-2026-35459, GHSA-7gvf-3w72-p2pgpyLoad: SSRF filter bypass via HTTP redirect in BaseDownloader (Incomplete fix for CVE-2026-33992)
Modified: 7/1/2026
CRITICAL9.8PyPI
PYSEC-2026-496· CVE-2025-53890, GHSA-8w3f-4r8f-pf53pyLoad vulnerable to XSS through insecure CAPTCHA
Modified: 7/9/2026
—PyPI
PYSEC-2026-497· CVE-2026-33992, GHSA-m74m-f7cr-432xpyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration
Modified: 7/1/2026
CRITICAL9.8PyPI
PYSEC-2026-498· CVE-2023-0297, GHSA-pf38-5p22-x6h6Code Injection in pyload-ng
Modified: 7/1/2026
CRITICAL9.8PyPI
PYSEC-2026-499· CVE-2024-39205, GHSA-r9pp-r4xf-597rpyload-ng vulnerable to RCE with js2py sandbox escape
Modified: 7/1/2026
HIGH7.4PyPI
PYSEC-2026-903· CVE-2023-0509, GHSA-8v53-23mx-hcf9Improper Certificate Validation in pyload-ng
Modified: 7/7/2026
MEDIUM6.1PyPI
PYSEC-2026-904· CVE-2023-0057, GHSA-h8r9-467r-vjjfpyLoad vulnerable to Improper Restriction of Rendered UI Layers or Frames
Modified: 7/7/2026
MEDIUM5.3PyPI
PYSEC-2026-905· CVE-2023-0055, GHSA-m3g7-wrrq-v5c8Pyload contains Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Modified: 7/7/2026
MEDIUM6.5PyPI
PYSEC-2026-906· CVE-2023-0227, GHSA-rv9x-wmw4-44qjPyload Insufficient Session Expiration vulnerability
Modified: 7/7/2026
MEDIUM5.4PyPI
PYSEC-2026-907· CVE-2023-0488, GHSA-wcm6-wv95-7jw6Cross-site Scripting in pyload-ng
Modified: 7/7/2026
MEDIUM5.4PyPI
PYSEC-2026-908· CVE-2023-0434, GHSA-x9vc-5q77-m7x4Improper Input Validation in pyload-ng
Modified: 7/7/2026
HIGH7.7PyPI
GHSA-2wvg-62qm-gj33· CVE-2026-35187, PYSEC-2026-2988pyLoad: SSRF in parse_urls API endpoint via unvalidated URL parameter
Modified: 7/13/2026
CRITICAL9.1PyPI
GHSA-3f7w-p8vr-4v5f· CVE-2024-32880, PYSEC-2026-492pyLoad allows upload to arbitrary folder lead to RCE
Modified: 9/10/2026
MEDIUM4.3PyPI
GHSA-3wwm-hjv7-23r3Pyload log Injection via API /json/add_package in add_name parameter
Modified: 7/30/2025
HIGH7.5PyPI
GHSA-4744-96p5-mp2j· CVE-2026-35464, PYSEC-2026-2989pyLoad: Unprotected storage_folder enables arbitrary file write to Flask session store and code execution (Incomplete fix for CVE-2026-33509)
Modified: 9/10/2026
CRITICAL9.8PyPI
GHSA-48rp-jc79-2264· CVE-2025-54802, PYSEC-2026-493pyLoad CNL Blueprint allows Path Traversal through `dlc_path` which leads to Remote Code Execution (RCE)
Modified: 9/10/2026
HIGH8.8PyPI
GHSA-66hx-chf7-3332· CVE-2026-41133, PYSEC-2026-2990pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)
Modified: 7/13/2026
CRITICAL9.8PyPI
GHSA-6jmx-pv77-wm5w· CVE-2023-0435, PYSEC-2026-494Excessive Attack Surface in pyload-ng
Modified: 6/29/2026
HIGH7.1PyPI
GHSA-6px9-j4qr-xfjw· CVE-2026-29778, PYSEC-2026-121pyLoad has an Arbitrary File Write via Path Traversal in edit_package()
Modified: 6/8/2026
CRITICALPyPI
GHSA-7gvf-3w72-p2pg· CVE-2026-35459, PYSEC-2026-495pyLoad: SSRF filter bypass via HTTP redirect in BaseDownloader (Incomplete fix for CVE-2026-33992)
Modified: 6/29/2026
HIGH8.1PyPI
GHSA-838g-gr43-qqg9· CVE-2026-42315, PYSEC-2026-129PyLoad vulnerable to Path Traversal via Package Folder Name in set_package_data
Modified: 6/8/2026
MEDIUM5.0PyPI
GHSA-8rp3-xc6w-5qp5· CVE-2026-46561, PYSEC-2026-2991pyload-ng: SSRF via HTTP Redirect Bypass in parse_urls API
Modified: 7/13/2026
HIGH7.4PyPI
GHSA-8v53-23mx-hcf9· CVE-2023-0509, PYSEC-2026-903Improper Certificate Validation in pyload-ng
Modified: 7/7/2026
CRITICAL9.8PyPI
GHSA-8w3f-4r8f-pf53· CVE-2025-53890, PYSEC-2026-496pyLoad vulnerable to XSS through insecure CAPTCHA
Modified: 9/10/2026
MEDIUM6.5PyPI
GHSA-97r3-5w84-r4q8· CVE-2026-42314, PYSEC-2026-128PyLoad Vulnerable to Path Traversal via Package Folder Name
Modified: 6/8/2026
HIGHPyPI
GHSA-9gjj-6gj7-c4wj· CVE-2025-57751, PYSEC-2026-1815Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs
Modified: 7/7/2026
MEDIUM6.5PyPI
GHSA-c2f9-4mc8-j656· CVE-2026-48987, PYSEC-2026-2992pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager
Modified: 7/13/2026
MEDIUM5.3PyPI
GHSA-c3gc-9pf2-84gg· CVE-2026-44226, PYSEC-2026-2993PyLoad vulnerable to unauthenticated traceback disclosure via global exception handler in WebUI
Modified: 7/13/2026
MEDIUM6.8PyPI
GHSA-ccxc-x975-4hh9· CVE-2026-42312, PYSEC-2026-126pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification via unrestricted `ssl_verify` config (incomplete fix for CVE-2026-33509 / -35463 / -35464 / -35586)
Modified: 6/8/2026
HIGH8.1PyPI
GHSA-cjjf-27cc-pvmv· CVE-2025-61773, PYSEC-2026-1816pyLoad CNL and captcha handlers allow Code Injection via unsanitized parameters
Modified: 7/7/2026
HIGH8.7PyPI
GHSA-fcjq-435v-jx94· CVE-2026-45348, PYSEC-2026-2994pyLoad is vulnerable to stored XSS in Downloads view via unsanitized link URL in packages.js template literal
Modified: 7/13/2026
LOWPyPI
GHSA-fj52-5g4h-gmq8pyLoad's Session Not Invalidated After Permission Changes
Modified: 4/14/2026
MEDIUM6.1PyPI
GHSA-g3cm-qg2v-2hj5· CVE-2024-24808, PYSEC-2026-1817pyLoad open redirect vulnerability due to improper validation of the is_safe_url function
Modified: 9/10/2026
MEDIUM5.3PyPI
GHSA-ghmw-rwh8-6qmr· CVE-2024-21645, PYSEC-2026-1818pyload Log Injection vulnerability
Modified: 9/10/2026
HIGH7.6PyPI
GHSA-h73m-pcfw-25h2· CVE-2023-47890, PYSEC-2026-1819Download to arbitrary folder can lead to RCE
Modified: 7/7/2026
MEDIUM6.1PyPI
GHSA-h8r9-467r-vjjf· CVE-2023-0057, PYSEC-2026-904pyLoad vulnerable to Improper Restriction of Rendered UI Layers or Frames
Modified: 7/7/2026
MEDIUM5.3PyPI
GHSA-m3g7-wrrq-v5c8· CVE-2023-0055, PYSEC-2026-905Pyload contains Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Modified: 7/7/2026
MEDIUM4.9PyPI
GHSA-m5x5-28jr-gpjj· CVE-2026-48737, PYSEC-2026-2995pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs
Modified: 7/13/2026
CRITICALPyPI
GHSA-m74m-f7cr-432x· CVE-2026-33992, PYSEC-2026-497pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration
Modified: 6/29/2026
MEDIUM4.8PyPI
GHSA-mp82-fmj6-f22v· CVE-2026-40594, PYSEC-2026-125pyLoad has a Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)
Modified: 6/8/2026
HIGH7.5PyPI
GHSA-mqpq-2p68-46fv· CVE-2024-21644, PYSEC-2026-1820pyload Unauthenticated Flask Configuration Leakage vulnerability
Modified: 9/10/2026
MEDIUM5.3PyPI
GHSA-mvwx-582f-56r7· CVE-2026-35592, PYSEC-2026-124pyload-ng: Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix Bypass
Modified: 6/8/2026
CRITICAL9.8PyPI
GHSA-pf38-5p22-x6h6· CVE-2023-0297, PYSEC-2026-498Code Injection in pyload-ng
Modified: 6/29/2026
HIGH8.3PyPI
GHSA-pg67-9wjv-mr85· CVE-2026-42313, PYSEC-2026-127pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy via unrestricted `proxy.*` config (incomplete fix for CVE-2026-33509 / -35463 / -35464 / -35586)
Modified: 6/8/2026
CRITICAL9.6PyPI
GHSA-pgpj-v85q-h5fm· CVE-2024-22416, PYSEC-2024-17Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation
Modified: 9/10/2026
MEDIUM6.8PyPI
GHSA-ppvx-rwh9-7rj7· CVE-2026-35586, PYSEC-2026-123pyload-ng: Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ng
Modified: 6/8/2026
HIGHPyPI
GHSA-pwh4-6r3m-j2rf· CVE-2025-55156, PYSEC-2026-1821PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameter
Modified: 7/7/2026
MEDIUM6.5PyPI
GHSA-q485-cg9q-xq2r· CVE-2026-33314, PYSEC-2026-122Improper Authentication and Origin Validation Error in pyload-ng
Modified: 6/8/2026
HIGH7.5PyPI
GHSA-r7mc-x6x7-cqxx· CVE-2026-33509, PYSEC-2026-2996pyLoad SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration
Modified: 7/13/2026
CRITICAL9.8PyPI
GHSA-r9pp-r4xf-597r· CVE-2024-39205, PYSEC-2026-499pyload-ng vulnerable to RCE with js2py sandbox escape
Modified: 6/29/2026
MEDIUM5.4PyPI
GHSA-rfgh-63mg-8pwm· CVE-2026-40071, PYSEC-2026-2997pyload-ng has a WebUI JSON permission mismatch that lets ADD/DELETE users invoke MODIFY-only actions
Modified: 9/10/2026
MEDIUM6.5PyPI
GHSA-rv9x-wmw4-44qj· CVE-2023-0227, PYSEC-2026-906Pyload Insufficient Session Expiration vulnerability
Modified: 7/7/2026
HIGH8.8PyPI
GHSA-w48f-wwwf-f5fr· CVE-2026-35463, PYSEC-2026-2267pyLoad: Improper Neutralization of Special Elements used in an OS Command
Modified: 7/13/2026
MEDIUM6.5PyPI
GHSA-w727-595x-pc3r· CVE-2026-45306, PYSEC-2026-2998pyLoad Has Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory in pyLoad
Modified: 7/13/2026
CRITICAL9.1PyPI
GHSA-w7hq-f2pj-c53g· CVE-2024-47821, PYSEC-2024-302pyLoad vulnerable to remote code execution by download to /.pyload/scripts using /flashgot API
Modified: 6/8/2026
MEDIUM5.4PyPI
GHSA-wcm6-wv95-7jw6· CVE-2023-0488, PYSEC-2026-907Cross-site Scripting in pyload-ng
Modified: 7/7/2026
HIGH7.5PyPI
GHSA-x698-5hjm-w2m5· CVE-2025-7346, PYSEC-2026-1822pyLoad is vulnerable to attacks that bypass localhost restrictions, enabling the creation of arbitrary packages
Modified: 7/7/2026
MEDIUM5.4PyPI
GHSA-x9vc-5q77-m7x4· CVE-2023-0434, PYSEC-2026-908Improper Input Validation in pyload-ng
Modified: 7/7/2026
HIGH7.5PyPI
GHSA-xqpg-92fq-grfg· CVE-2025-54140, PYSEC-2026-1823`pyLoad` has Path Traversal Vulnerability in `json/upload` Endpoint that allows Arbitrary File Write
Modified: 7/7/2026