pyload-ng vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-35464Highpyload-ng: pyLoad: Unprotected storage_folder enables arbitrary file write to Flask session store and code execution (Incomplete fix for…CVE-2026-35463Highpyload-ng: pyLoad: Improper Neutralization of Special Elements used in an OS CommandCVE-2026-35459Criticalpyload-ng: pyLoad: SSRF filter bypass via HTTP redirect in BaseDownloader (Incomplete fix for CVE-2026-33992)CVE-2026-35187Highpyload-ng: pyLoad: SSRF in parse_urls API endpoint via unvalidated URL parameterCVE-2026-33992Criticalpyload-ng: pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata ExfiltrationCVE-2026-33509Highpyload-ng: pyLoad SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script ConfigurationCVE-2026-33314Mediumpyload-ng: Improper Authentication and Origin Validation Error in pyload-ngCVE-2026-29778Highpyload-ng: pyLoad has an Arbitrary File Write via Path Traversal in edit_package()CVE-2025-61773Highpyload-ng: pyLoad CNL and captcha handlers allow Code Injection via unsanitized parametersCVE-2025-57751Highpyload-ng: Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljsCVE-2025-55156Highpyload-ng: PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameterCVE-2025-54802Criticalpyload-ng: pyLoad CNL Blueprint allows Path Traversal through `dlc_path` which leads to Remote Code Execution (RCE)GHSA-3WWM-HJV7-23R3Mediumpyload-ng: Pyload log Injection via API /json/add_package in add_name parameterCVE-2025-54140Highpyload-ng: `pyLoad` has Path Traversal Vulnerability in `json/upload` Endpoint that allows Arbitrary File WriteCVE-2025-53890Criticalpyload-ng: pyLoad vulnerable to XSS through insecure CAPTCHA CVE-2025-7346Highpyload-ng: pyLoad is vulnerable to attacks that bypass localhost restrictions, enabling the creation of arbitrary packagesCVE-2024-47821Highpyload-ng: pyLoad vulnerable to remote code execution by download to /.pyload/scripts using /flashgot APICVE-2024-39205Criticalpyload-ng: pyload-ng vulnerable to RCE with js2py sandbox escapeCVE-2024-32880Criticalpyload-ng: pyLoad allows upload to arbitrary folder lead to RCECVE-2024-24808Mediumpyload-ng: pyLoad open redirect vulnerability due to improper validation of the is_safe_url functionCVE-2024-22416Criticalpyload-ng: Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalationCVE-2024-21644Highpyload-ng: pyload Unauthenticated Flask Configuration Leakage vulnerabilityCVE-2024-21645Mediumpyload-ng: pyload Log Injection vulnerabilityCVE-2023-47890Highpyload-ng: Download to arbitrary folder can lead to RCECVE-2023-0509Highpyload-ng: Improper Certificate Validation in pyload-ng

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo