Skip to contentPyload-ng Project Pyload-ng vulnerabilities
- pyload, pyload-ng project pyload-ng +1 morepyLoad: Path Traversal via Package Folder Name in set_package_dataCVE-2026-42315Fix available8.1 High
- pyload, pyload-ng project pyload-ng +1 morepyLoad: Path Traversal via Package Folder NameCVE-2026-42314Fix available6.5 Medium
- pyload, pyload-ng project pyload-ng +1 morepyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxyCVE-2026-42313Fix available8.3 High
- pyload, pyload-ng project pyload-ng +1 morepyload-ng: non-admin SETTINGS users can disable outbound TLS peer verificationCVE-2026-42312Fix available6.8 Medium
- pyload, pyload-ng project pyload-ng +1 morepyLoad: Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)CVE-2026-40594Fix available4.8 Medium
- pyload, pyload-ng project pyload-ng +1 morepyLoad has an Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix BypassCVE-2026-35592Fix available5.3 Medium
- pyload, pyload-ng project pyload-ng +1 moreAuthorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ngCVE-2026-35586Fix available6.8 Medium
- pyload, pyload-ng project pyload-ng +1 morepyLoad has Improper Neutralization of Special Elements used in an OS CommandCVE-2026-35463Fix available8.8 High
- pyload, pyload-ng project pyload-ng +1 morepyLoad has SSRF fix bypass via HTTP redirectCVE-2026-354599.3 Critical
- pyload, pyload-ng project pyload-ng +1 morepyLoad has SSRF in parse_urls API endpoint via unvalidated URL parameterCVE-2026-351877.7 High
- pyload, pyload-ng project pyload-ng +1 morepyload-ng: Authentication Bypass via Host Header Injection in ClickNLoadCVE-2026-335118.8 High
- pyload, pyload-ng project pyload-ng +1 morepyload-ng: SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script ConfigurationCVE-2026-335097.5 High
- pyload, pyload-ng project pyload-ng +1 morepyLoad: Arbitrary File Deletion via Path Traversal during Encrypted 7z Password VerificationCVE-2026-328088.1 High
- pyload, pyload-ng project pyload-ng +1 morepyload-ng: Improper Authentication and Origin Validation ErrorCVE-2026-33314Fix available6.5 Medium
- pyload, pyload-ng project pyload-ng +1 morepyLoad: Arbitrary File Write via Path Traversal in edit_package()CVE-2026-29778Fix available7.1 High
- pyload, pyload-ng project pyload-ng +1 morepyLoad CNL Blueprint is vulnerable to Path Traversal through `dlc_path` leading to Remote Code Execution (RCE)CVE-2025-54802Fix available9.8 Critical
- pyload-ng project pyload-ngpyload-ng vulnerable to RCE with js2py sandbox escapeCVE-2024-39205Public exploitEPSS 16.5%9.8 Critical
- pyload, pyload-ng project pyload-ng +1 moreCross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalationCVE-2024-22416Public exploitFix available9.7 Critical
- pyload, pyload pyload/pyload, pyload-ng project pyload-ng +2 moreImproper Certificate Validation in pyload/pyloadCVE-2023-0509Fix available7.4 High
- pyload, pyload pyload/pyload, pyload-ng project pyload-ng +2 moreCross-site Scripting (XSS) - Stored in pyload/pyloadCVE-2023-0488Fix available9.6 Critical
- pyload, pyload pyload/pyload, pyload-ng project pyload-ng +2 moreImproper Restriction of Rendered UI Layers or Frames in pyload/pyloadCVE-2023-0057Fix available3.1 Low