High
ghsa-68w4-83fh-f2w8
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 58
Reset filters
Medium
ghsa-9q47-3cm2-2rp8
pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header
High
ghsa-jq7h-wrvp-3rgx
pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session
High
ghsa-889w-m37p-88m5
pyLoad: Api.set_user_permission never invalidates the target's session
Medium
ghsa-p3pr-8f3m-4qp8
pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host
High
ghsa-fr26-jjhm-638c
pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)
High
ghsa-r44w-v6gf-x3p6
pyLoad has an authentication bypass in API key validation (check_apikey cache)
Medium
CVE-2026-75597
pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo
Medium
CVE-2026-48484
pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination
Medium
CVE-2026-48737
pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs
Medium
CVE-2026-48987
pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager
Medium
CVE-2026-46561
pyload-ng: SSRF via HTTP Redirect Bypass in parse_urls API
High
CVE-2026-45348
pyLoad is vulnerable to stored XSS in Downloads view via unsanitized link URL in packages.js template literal
Medium
CVE-2026-45306
pyLoad Has Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory in pyLoad
Medium
CVE-2026-44226
PyLoad vulnerable to unauthenticated traceback disclosure via global exception handler in WebUI
High
CVE-2026-41133
pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)
Medium
CVE-2026-40071
pyload-ng has a WebUI JSON permission mismatch that lets ADD/DELETE users invoke MODIFY-only actions
High
CVE-2026-35464
pyLoad: Unprotected storage_folder enables arbitrary file write to Flask session store and code execution (Incomplete fix for CVE-2026-33509)
High
CVE-2026-35187
pyLoad: SSRF in parse_urls API endpoint via unvalidated URL parameter
High
CVE-2026-33509
pyLoad SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration
High
CVE-2025-61773
pyLoad CNL and captcha handlers allow Code Injection via unsanitized parameters
High
CVE-2025-57751
Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs
High
CVE-2025-55156
PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameter
High
CVE-2025-54140
`pyLoad` has Path Traversal Vulnerability in `json/upload` Endpoint that allows Arbitrary File Write
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.