Pyload - vulnerabilities (CVEs)

50 CVEs in 2 products, 2 in the last 30 days, newest from 2026-10-09.

Products

Pyload - 40 CVEs
Pyloadpyload - 9 CVEs

Newest CVEs of Pyload

CVE-2026-75597 - CVSS 5.3 (medium), 2026-10-09: pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the `/web/<path:filename>` route in…
CVE-2026-48484 - CVSS 6.5 (medium), 2026-10-09: pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API `rpc` function in `api_blueprint.py` handles…
CVE-2026-48987 - CVSS 6.5 (medium), 2026-09-15: pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, EventManager in src/pyload/core/managers/event_manager.py…
CVE-2026-48737 - CVSS 4.9 (medium), 2026-09-15: pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, is_global_address in src/pyload/core/utils/web/check.py relies…
CVE-2026-46561 - CVSS 5 (medium), 2026-05-28: pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the PREREQFUNCTION-based private IP check was not applied to…
CVE-2026-45348 - CVSS 8.7 (high), 2026-05-28: pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the packages.js template at…
CVE-2026-45306 - CVSS 6.5 (medium), 2026-05-28: pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the fix for CVE-2026-33509 prevents setting storage_folder…
CVE-2026-44226 - CVSS 5.3 (medium), 2026-05-11: pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, pyload-ng WebUI returns full Python traceback details to clients…
CVE-2026-42315 - CVSS 8.1 (high), 2026-05-11: pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, when passing a folder name in the set_package_data() API…
CVE-2026-42314 - CVSS 6.5 (medium), 2026-05-11: pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, package folder names are sanitized using insufficient string…
CVE-2026-42313 - CVSS 8.3 (high), 2026-05-11: pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_value() API method (@permission(Perms.SETTINGS))…
CVE-2026-42312 - CVSS 6.8 (medium), 2026-05-11: pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_value() API method (@permission(Perms.SETTINGS))…
CVE-2026-41133 - CVSS 8.8 (high), 2026-04-22: pyLoad is a free and open-source download manager written in Python. Versions up to and including 0.5.0b3.dev97 cache `role` and `permission` in the session…
CVE-2026-40594 - CVSS 4.8 (medium), 2026-04-21: pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev98, the set_session_cookie_secure before_request handler in…
CVE-2026-40071 - CVSS 5.4 (medium), 2026-04-09: pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the /json/package_order, /json/link_order, and /json/abort_link…
CVE-2026-35592 - CVSS 6.5 (medium), 2026-04-07: pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the _safe_extractall() function in…
CVE-2026-35586 - CVSS 6.8 (medium), 2026-04-07: pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the ADMIN_ONLY_CORE_OPTIONS authorization set in…
CVE-2026-35464 - CVSS 7.5 (high), 2026-04-07: pyLoad is a free and open-source download manager written in Python. The fix for CVE-2026-33509 added an ADMIN_ONLY_OPTIONS set to block non-admin users from…
CVE-2026-35463 - CVSS 8.8 (high), 2026-04-07: pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the ADMIN_ONLY_OPTIONS protection mechanism restricts…
CVE-2026-35459 - CVSS 9.3 (critical), 2026-04-06: pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, pyLoad has a server-side request forgery (SSRF)…
CVE-2026-35187 - CVSS 7.7 (high), 2026-04-06: pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the parse_urls API function in…
CVE-2026-33992 - CVSS 9.3 (critical), 2026-03-27: pyLoad is a free and open-source download manager written in Python. Prior to version 0.5.0b3.dev97, PyLoad's download engine accepts arbitrary URLs without…
CVE-2026-33509 - CVSS 8.8 (high), 2026-03-24: pyLoad is a free and open-source download manager written in Python. From version 0.4.0 to before version 0.5.0b3.dev97, the set_config_value() API endpoint…
CVE-2026-33511 - CVSS 9.8 (critical), 2026-03-24: pyLoad is a free and open-source download manager written in Python. From version 0.4.20 to before version 0.5.0b3.dev97, the local_check decorator in…
CVE-2026-33314 - CVSS 6.5 (medium), 2026-03-24: pyLoad is a free and open-source download manager written in Python. Prior to version 0.5.0b3.dev97, a Host Header Spoofing vulnerability in the @local_check…
CVE-2026-32808 - CVSS 8.1 (high), 2026-03-20: pyLoad is a free and open-source download manager written in Python. Versions before 0.5.0b3.dev97 are vulnerable to path traversal during password…
CVE-2026-29778 - CVSS 7.1 (high), 2026-03-07: pyLoad is a free and open-source download manager written in Python. From version 0.5.0b3.dev13 to 0.5.0b3.dev96, the edit_package() function implements…
CVE-2025-61773 - CVSS 8.1 (high), 2025-10-09: pyLoad is a free and open-source download manager written in Python. In versions prior to 0.5.0b3.dev91, pyLoad web interface contained insufficient input…
CVE-2025-57751 - CVSS 7.7 (high), 2025-08-21: pyLoad is the free and open-source Download Manager written in pure Python. The jk parameter is received in pyLoad CNL Blueprint. Due to the lack of jk…
CVE-2025-55156 - CVSS 7.8 (high), 2025-08-11: pyLoad is the free and open-source Download Manager written in pure Python. Prior to version 0.5.0b3.dev91, the parameter add_links in API /json/add_package…