High
CVE-2025-7346
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 58
Reset filters
Medium
CVE-2024-24808
pyLoad open redirect vulnerability due to improper validation of the is_safe_url function
Medium
CVE-2024-21645
pyload Log Injection vulnerability
High
CVE-2024-21644
pyload Unauthenticated Flask Configuration Leakage vulnerability
High
CVE-2023-47890
Download to arbitrary folder can lead to RCE
Medium
CVE-2023-0434
Improper Input Validation in pyload-ng
Medium
CVE-2023-0488
Cross-site Scripting in pyload-ng
High
CVE-2023-0509
Improper Certificate Validation in pyload-ng
Medium
CVE-2023-0227
Pyload Insufficient Session Expiration vulnerability
Medium
CVE-2023-0055
Pyload contains Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Medium
CVE-2023-0057
pyLoad vulnerable to Improper Restriction of Rendered UI Layers or Frames
Critical
CVE-2024-32880
pyLoad allows upload to arbitrary folder lead to RCE
Critical
CVE-2025-54802
pyLoad CNL Blueprint allows Path Traversal through `dlc_path` which leads to Remote Code Execution (RCE)
Critical
CVE-2025-53890
pyLoad vulnerable to XSS through insecure CAPTCHA
High
CVE-2026-42315
PyLoad vulnerable to Path Traversal via Package Folder Name in set_package_data
Medium
CVE-2026-42314
PyLoad Vulnerable to Path Traversal via Package Folder Name
High
CVE-2026-42313
pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy via unrestricted `proxy.*` config (incomplete fix for CVE-2026-33509 / -35463 / -35464 / -35586)
Medium
CVE-2026-42312
pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification via unrestricted `ssl_verify` config (incomplete fix for CVE-2026-33509 / -35463 / -35464 / -35586)
Medium
CVE-2026-40594
pyLoad has a Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)
Low
ghsa-fj52-5g4h-gmq8
pyLoad's Session Not Invalidated After Permission Changes
Medium
CVE-2026-35592
pyload-ng: Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix Bypass
Medium
CVE-2026-35586
pyload-ng: Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ng
High
CVE-2026-35463
pyLoad: Improper Neutralization of Special Elements used in an OS Command
Critical
CVE-2026-35459
pyLoad: SSRF filter bypass via HTTP redirect in BaseDownloader (Incomplete fix for CVE-2026-33992)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.