Pyload-ng Project vulnerabilities

Products

• Pyload-ng 21

Newest

• pyload, pyload-ng project pyload-ng +1 more pyLoad: Path Traversal via Package Folder Name in set_package_data CVE-2026-42315 Fix available 8.1 HighMay 5, 2026
• pyload, pyload-ng project pyload-ng +1 more pyLoad: Path Traversal via Package Folder Name CVE-2026-42314 Fix available 6.5 MediumMay 5, 2026
• pyload, pyload-ng project pyload-ng +1 more pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy CVE-2026-42313 Fix available 8.3 HighMay 4, 2026
• pyload, pyload-ng project pyload-ng +1 more pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification CVE-2026-42312 Fix available 6.8 MediumMay 4, 2026
• pyload, pyload-ng project pyload-ng +1 more pyLoad: Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition) CVE-2026-40594 Fix available 4.8 MediumApril 16, 2026
• pyload, pyload-ng project pyload-ng +1 more pyLoad has an Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix Bypass CVE-2026-35592 Fix available 5.3 MediumApril 7, 2026
• pyload, pyload-ng project pyload-ng +1 more Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ng CVE-2026-35586 Fix available 6.8 MediumApril 7, 2026
• pyload, pyload-ng project pyload-ng +1 more pyLoad has Improper Neutralization of Special Elements used in an OS Command CVE-2026-35463 Fix available 8.8 HighApril 4, 2026
• pyload, pyload-ng project pyload-ng +1 more pyLoad has SSRF fix bypass via HTTP redirect CVE-2026-35459 9.3 CriticalApril 4, 2026
• pyload, pyload-ng project pyload-ng +1 more pyLoad has SSRF in parse_urls API endpoint via unvalidated URL parameter CVE-2026-35187 7.7 HighApril 4, 2026
• pyload, pyload-ng project pyload-ng +1 more pyload-ng: Authentication Bypass via Host Header Injection in ClickNLoad CVE-2026-33511 8.8 HighMarch 24, 2026
• pyload, pyload-ng project pyload-ng +1 more pyload-ng: SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration CVE-2026-33509 7.5 HighMarch 20, 2026
• pyload, pyload-ng project pyload-ng +1 more pyLoad: Arbitrary File Deletion via Path Traversal during Encrypted 7z Password Verification CVE-2026-32808 8.1 HighMarch 20, 2026
• pyload, pyload-ng project pyload-ng +1 more pyload-ng: Improper Authentication and Origin Validation Error CVE-2026-33314 Fix available 6.5 MediumMarch 19, 2026
• pyload, pyload-ng project pyload-ng +1 more pyLoad: Arbitrary File Write via Path Traversal in edit_package() CVE-2026-29778 Fix available 7.1 HighMarch 5, 2026
• pyload, pyload-ng project pyload-ng +1 more pyLoad CNL Blueprint is vulnerable to Path Traversal through `dlc_path` leading to Remote Code Execution (RCE) CVE-2025-54802 Fix available 9.8 CriticalAugust 4, 2025
• pyload-ng project pyload-ng pyload-ng vulnerable to RCE with js2py sandbox escape CVE-2024-39205 Public exploit EPSS 16.5% 9.8 CriticalSeptember 9, 2024
• pyload, pyload-ng project pyload-ng +1 more Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation CVE-2024-22416 Public exploitFix available 9.7 CriticalJanuary 17, 2024
• pyload, pyload pyload/pyload, pyload-ng project pyload-ng +2 more Improper Certificate Validation in pyload/pyload CVE-2023-0509 Fix available 7.4 HighJanuary 26, 2023
• pyload, pyload pyload/pyload, pyload-ng project pyload-ng +2 more Cross-site Scripting (XSS) - Stored in pyload/pyload CVE-2023-0488 Fix available 9.6 CriticalJanuary 26, 2023
• pyload, pyload pyload/pyload, pyload-ng project pyload-ng +2 more Improper Restriction of Rendered UI Layers or Frames in pyload/pyload CVE-2023-0057 Fix available 3.1 LowJanuary 5, 2023