pyload-ng vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-68W4-83FH-F2W8Highpyload-ng: pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator passwordGHSA-9Q47-3CM2-2RP8Mediumpyload-ng: pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` HeaderGHSA-JQ7H-WRVP-3RGXHighpyload-ng: pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's sessionGHSA-889W-M37P-88M5Highpyload-ng: pyLoad: Api.set_user_permission never invalidates the target's sessionGHSA-P3PR-8F3M-4QP8Mediumpyload-ng: pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification hostGHSA-FR26-JJHM-638CHighpyload-ng: pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)GHSA-R44W-V6GF-X3P6Highpyload-ng: pyLoad has an authentication bypass in API key validation (check_apikey cache)CVE-2026-75597Mediumpyload-ng: pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via…CVE-2026-48484Mediumpyload-ng: pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process TerminationCVE-2026-48987Mediumpyload-ng: pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManagerCVE-2026-48737Mediumpyload-ng: pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPsCVE-2026-46561Mediumpyload-ng: pyload-ng: SSRF via HTTP Redirect Bypass in parse_urls APICVE-2026-45348Highpyload-ng: pyLoad is vulnerable to stored XSS in Downloads view via unsanitized link URL in packages.js template literalCVE-2026-45306Mediumpyload-ng: pyLoad Has Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory in pyLoadCVE-2026-44226Mediumpyload-ng: PyLoad vulnerable to unauthenticated traceback disclosure via global exception handler in WebUICVE-2026-42315Highpyload-ng: PyLoad vulnerable to Path Traversal via Package Folder Name in set_package_dataCVE-2026-42314Mediumpyload-ng: PyLoad Vulnerable to Path Traversal via Package Folder NameCVE-2026-42313Highpyload-ng: pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy via unrestricted `proxy.*`…CVE-2026-42312Mediumpyload-ng: pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification via unrestricted `ssl_verify` config (incomplete fix for…CVE-2026-40594Mediumpyload-ng: pyLoad has a Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)GHSA-FJ52-5G4H-GMQ8Lowpyload-ng: pyLoad's Session Not Invalidated After Permission ChangesCVE-2026-41133Highpyload-ng: pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)CVE-2026-40071Mediumpyload-ng: pyload-ng has a WebUI JSON permission mismatch that lets ADD/DELETE users invoke MODIFY-only actionsCVE-2026-35592Mediumpyload-ng: pyload-ng: Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix BypassCVE-2026-35586Mediumpyload-ng: pyload-ng: Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ng

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo