{"items":[{"id":"CVE-2026-75597","published":"2026-10-09T16:41:21.081Z","updated":"2026-10-09T17:04:31.503Z","title":"pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo","severity":"MEDIUM","score":5.3,"vendor":"pyload","product":"pyload","kev":false,"epss":0.00296,"kevAdded":null,"exploit":true},{"id":"CVE-2026-48484","published":"2026-10-09T16:26:37.728Z","updated":"2026-10-14T02:00:47.553Z","title":"pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination","severity":"MEDIUM","score":6.5,"vendor":"pyload","product":"pyload","kev":false,"epss":0.00371,"kevAdded":null,"exploit":true},{"id":"CVE-2026-48987","published":"2026-09-15T14:41:43.887Z","updated":"2026-09-15T14:59:08.509Z","title":"pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager","severity":"MEDIUM","score":6.5,"vendor":"pyload","product":"pyload","kev":false,"epss":0.00436,"kevAdded":null,"exploit":true},{"id":"CVE-2026-48737","published":"2026-09-15T14:40:27.340Z","updated":"2026-09-16T16:04:53.088Z","title":"pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs","severity":"MEDIUM","score":4.9,"vendor":"pyload","product":"pyload","kev":false,"epss":0.00289,"kevAdded":null,"exploit":true},{"id":"CVE-2026-45306","published":"2026-05-28T17:12:59.835Z","updated":"2026-05-28T18:49:45.693Z","title":"pyLoad: Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory","severity":"MEDIUM","score":6.5,"vendor":"pyload","product":"pyload","kev":false,"epss":0.00234,"kevAdded":null,"exploit":true},{"id":"CVE-2026-45348","published":"2026-05-28T17:12:20.497Z","updated":"2026-05-28T18:51:28.477Z","title":"pyLoad: Stored XSS in Downloads view via unsanitized link URL in packages.js template literal","severity":"HIGH","score":8.7,"vendor":"pyload","product":"pyload","kev":false,"epss":0.00199,"kevAdded":null,"exploit":true},{"id":"CVE-2026-46561","published":"2026-05-28T17:11:28.966Z","updated":"2026-05-28T18:53:52.113Z","title":"pyLoad: SSRF via HTTP Redirect Bypass in parse_urls API","severity":"MEDIUM","score":5,"vendor":"pyload","product":"pyload","kev":false,"epss":0.00176,"kevAdded":null,"exploit":true},{"id":"CVE-2026-44226","published":"2026-05-11T16:36:35.156Z","updated":"2026-05-11T18:27:05.705Z","title":"pyLoad: Unauthenticated traceback disclosure via global exception handler in WebUI","severity":"MEDIUM","score":5.3,"vendor":"pyload","product":"pyload","kev":false,"epss":0.00336,"kevAdded":null,"exploit":true},{"id":"CVE-2026-42315","published":"2026-05-11T16:35:32.099Z","updated":"2026-05-11T20:16:10.716Z","title":"pyLoad: Path Traversal via Package Folder Name in set_package_data","severity":"HIGH","score":8.1,"vendor":"pyload","product":"pyload","kev":false,"epss":0.00395,"kevAdded":null,"exploit":true},{"id":"CVE-2026-42314","published":"2026-05-11T16:34:05.918Z","updated":"2026-05-11T18:33:46.606Z","title":"pyLoad: Path Traversal via Package Folder Name","severity":"MEDIUM","score":6.5,"vendor":"pyload","product":"pyload","kev":false,"epss":0.00342,"kevAdded":null,"exploit":true},{"id":"CVE-2026-42312","published":"2026-05-11T16:32:00.329Z","updated":"2026-05-11T19:06:12.697Z","title":"pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification","severity":"MEDIUM","score":6.8,"vendor":"pyload","product":"pyload","kev":false,"epss":0.00174,"kevAdded":null,"exploit":true},{"id":"CVE-2026-42313","published":"2026-05-11T16:30:39.564Z","updated":"2026-05-12T13:51:11.248Z","title":"pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy","severity":"HIGH","score":8.3,"vendor":"pyload","product":"pyload","kev":false,"epss":0.00396,"kevAdded":null,"exploit":true},{"id":"CVE-2026-41133","published":"2026-04-21T23:41:06.258Z","updated":"2026-04-22T18:35:41.768Z","title":"pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)","severity":"HIGH","score":8.8,"vendor":"pyload","product":"pyload","kev":false,"epss":0.00325,"kevAdded":null,"exploit":true},{"id":"CVE-2026-40594","published":"2026-04-21T17:14:03.627Z","updated":"2026-04-21T18:01:30.556Z","title":"pyLoad: Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)","severity":"MEDIUM","score":4.8,"vendor":"pyload","product":"pyload","kev":false,"epss":0.00171,"kevAdded":null,"exploit":true},{"id":"CVE-2026-40071","published":"2026-04-09T17:36:24.837Z","updated":"2026-04-10T14:09:11.900Z","title":"pyLoad WebUI JSON permission mismatch lets ADD/DELETE users invoke MODIFY-only actions","severity":"MEDIUM","score":5.4,"vendor":"pyload","product":"pyload","kev":false,"epss":0.00227,"kevAdded":null,"exploit":true},{"id":"CVE-2026-35592","published":"2026-04-07T16:11:38.209Z","updated":"2026-04-08T14:58:21.343Z","title":"pyLoad has an Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix Bypass","severity":"MEDIUM","score":5.3,"vendor":"pyload","product":"pyload","kev":false,"epss":0.00265,"kevAdded":null,"exploit":true},{"id":"CVE-2026-35586","published":"2026-04-07T16:09:11.856Z","updated":"2026-04-07T18:16:14.387Z","title":"Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ng","severity":"MEDIUM","score":6.8,"vendor":"pyload","product":"pyload","kev":false,"epss":0.00147,"kevAdded":null,"exploit":true},{"id":"CVE-2026-35464","published":"2026-04-07T14:38:02.480Z","updated":"2026-04-07T15:58:59.013Z","title":"pyLoad has an incomplete fix for CVE-2026-33509: unprotected storage_folder enables arbitrary file write to Flask session store and code execution","severity":"HIGH","score":7.5,"vendor":"pyload","product":"pyload","kev":false,"epss":0.00548,"kevAdded":null,"exploit":true},{"id":"CVE-2026-35463","published":"2026-04-07T14:32:44.149Z","updated":"2026-04-08T14:46:07.056Z","title":"pyLoad has Improper Neutralization of Special Elements used in an OS Command","severity":"HIGH","score":8.8,"vendor":"pyload","product":"pyload","kev":false,"epss":0.00847,"kevAdded":null,"exploit":true},{"id":"CVE-2026-35459","published":"2026-04-06T19:37:00.598Z","updated":"2026-04-07T19:29:49.223Z","title":"pyLoad has SSRF fix bypass via HTTP redirect","severity":"CRITICAL","score":9.3,"vendor":"pyload","product":"pyload","kev":false,"epss":0.00284,"kevAdded":null,"exploit":true},{"id":"CVE-2026-35187","published":"2026-04-06T19:33:06.557Z","updated":"2026-04-07T14:03:28.344Z","title":"pyLoad has SSRF in parse_urls API endpoint via unvalidated URL parameter","severity":"HIGH","score":7.7,"vendor":"pyload","product":"pyload","kev":false,"epss":0.00279,"kevAdded":null,"exploit":true},{"id":"CVE-2026-33992","published":"2026-03-27T22:12:39.606Z","updated":"2026-03-30T18:29:06.744Z","title":"pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration","severity":"CRITICAL","score":9.3,"vendor":"pyload","product":"pyload","kev":false,"epss":0.00404,"kevAdded":null,"exploit":true},{"id":"CVE-2026-33511","published":"2026-03-24T18:56:08.886Z","updated":"2026-03-25T14:28:19.605Z","title":"pyload-ng: Authentication Bypass via Host Header Injection in ClickNLoad","severity":"HIGH","score":8.8,"vendor":"pyload","product":"pyload","kev":false,"epss":0.00438,"kevAdded":null,"exploit":true},{"id":"CVE-2026-33509","published":"2026-03-24T18:55:37.033Z","updated":"2026-03-26T19:52:12.902Z","title":"pyload-ng: SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration","severity":"HIGH","score":7.5,"vendor":"pyload","product":"pyload","kev":false,"epss":0.0055,"kevAdded":null,"exploit":true},{"id":"CVE-2026-33314","published":"2026-03-24T18:52:28.834Z","updated":"2026-03-26T19:52:13.088Z","title":"pyload-ng: Improper Authentication and Origin Validation Error","severity":"MEDIUM","score":6.5,"vendor":"pyload","product":"pyload","kev":false,"epss":0.0019,"kevAdded":null,"exploit":true},{"id":"CVE-2026-32808","published":"2026-03-20T01:45:07.446Z","updated":"2026-03-25T14:29:07.756Z","title":"pyLoad: Arbitrary File Deletion via Path Traversal during Encrypted 7z Password Verification","severity":"HIGH","score":8.1,"vendor":"pyload","product":"pyload","kev":false,"epss":0.0034,"kevAdded":null,"exploit":true},{"id":"CVE-2026-29778","published":"2026-03-07T15:28:36.919Z","updated":"2026-03-09T18:26:46.896Z","title":"pyLoad: Arbitrary File Write via Path Traversal in edit_package()","severity":"HIGH","score":7.1,"vendor":"pyload","product":"pyload","kev":false,"epss":0.00571,"kevAdded":null,"exploit":true},{"id":"CVE-2025-61773","published":"2025-10-09T20:49:53.892Z","updated":"2025-10-10T14:29:33.642Z","title":"pyLoad CNL and captcha handlers allow code Injection via unsanitized parameters","severity":"HIGH","score":8.1,"vendor":"pyload","product":"pyload","kev":false,"epss":0.00517,"kevAdded":null,"exploit":true},{"id":"CVE-2025-57751","published":"2025-08-21T18:27:04.620Z","updated":"2025-08-21T18:42:16.688Z","title":"Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs","severity":"HIGH","score":7.7,"vendor":"pyload","product":"pyload","kev":false,"epss":0.00325,"kevAdded":null,"exploit":true},{"id":"CVE-2025-55156","published":"2025-08-11T22:21:52.225Z","updated":"2025-08-12T15:49:56.057Z","title":"PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameter","severity":"HIGH","score":7.8,"vendor":"pyload","product":"pyload","kev":false,"epss":0.00363,"kevAdded":null,"exploit":true},{"id":"CVE-2025-54802","published":"2025-08-05T00:06:48.834Z","updated":"2025-08-05T14:29:43.201Z","title":"pyLoad CNL Blueprint is vulnerable to Path Traversal through `dlc_path` leading to Remote Code Execution (RCE)","severity":"CRITICAL","score":9.8,"vendor":"pyload","product":"pyload","kev":false,"epss":0.0139,"kevAdded":null,"exploit":true},{"id":"CVE-2025-54140","published":"2025-07-22T21:34:30.750Z","updated":"2025-07-23T18:28:44.036Z","title":"pyLoad has Path Traversal Vulnerability in json/upload Endpoint that allows Arbitrary File Write","severity":"HIGH","score":7.5,"vendor":"pyload","product":"pyload","kev":false,"epss":0.00753,"kevAdded":null,"exploit":true},{"id":"CVE-2025-53890","published":"2025-07-14T23:57:09.574Z","updated":"2025-07-15T19:48:50.099Z","title":"pyLoad vulnerable to remote code execution through js2py onCaptchaResult","severity":"CRITICAL","score":9.8,"vendor":"pyload","product":"pyload","kev":false,"epss":0.01298,"kevAdded":null,"exploit":true},{"id":"CVE-2025-7346","published":"2025-07-08T07:05:11.861Z","updated":"2025-07-08T14:14:15.199Z","title":"Any unauthenticated attacker can bypass the localhost restrictions posed by the application and utilize this to create arbitrary packages","severity":"HIGH","score":8.7,"vendor":"Pyload","product":"Pyload","kev":false,"epss":0.00376,"kevAdded":null,"exploit":true},{"id":"CVE-2024-1240","published":"2024-11-15T10:57:07.797Z","updated":"2024-11-15T19:07:26.471Z","title":"Open Redirection in pyload/pyload","severity":"MEDIUM","score":4.6,"vendor":"pyload","product":"pyload/pyload","kev":false,"epss":0.00341,"kevAdded":null,"exploit":true},{"id":"CVE-2024-47821","published":"2024-10-25T22:48:57.950Z","updated":"2024-10-28T19:41:54.018Z","title":"pyLoad vulnerable to remote code execution by download to /.pyload/scripts using /flashgot API","severity":"CRITICAL","score":9.1,"vendor":"pyload","product":"pyload","kev":false,"epss":0.00682,"kevAdded":null,"exploit":true},{"id":"CVE-2024-32880","published":"2024-04-26T17:30:24.685Z","updated":"2024-08-02T02:20:35.649Z","title":"pyLoad allows upload to arbitrary folder lead to RCE","severity":"CRITICAL","score":9.1,"vendor":"pyload","product":"pyload","kev":false,"epss":0.01354,"kevAdded":null,"exploit":false},{"id":"CVE-2024-24808","published":"2024-02-06T03:17:16.532Z","updated":"2025-05-09T16:31:14.196Z","title":"pyLoad open redirect vulnerability due to improper validation of the is_safe_url function","severity":"MEDIUM","score":4.7,"vendor":"pyload","product":"pyload","kev":false,"epss":0.00545,"kevAdded":null,"exploit":true},{"id":"CVE-2024-22416","published":"2024-01-17T23:48:31.422Z","updated":"2025-06-17T21:19:19.773Z","title":"Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation","severity":"CRITICAL","score":9.7,"vendor":"pyload","product":"pyload","kev":false,"epss":0.00948,"kevAdded":null,"exploit":false},{"id":"CVE-2024-21644","published":"2024-01-08T13:20:55.182Z","updated":"2025-06-17T20:39:15.676Z","title":"pyLoad unauthenticated flask configuration leakage","severity":"HIGH","score":7.5,"vendor":"pyload","product":"pyload","kev":false,"epss":0.42443,"kevAdded":null,"exploit":true},{"id":"CVE-2024-21645","published":"2024-01-08T13:20:47.181Z","updated":"2024-11-14T17:38:32.866Z","title":"pyLoad Log Injection","severity":"MEDIUM","score":5.3,"vendor":"pyload","product":"pyload","kev":false,"epss":0.24698,"kevAdded":null,"exploit":true},{"id":"CVE-2023-0509","published":"2023-01-26T00:00:00.000Z","updated":"2025-03-31T16:45:30.444Z","title":"Improper Certificate Validation in pyload/pyload","severity":"HIGH","score":7.4,"vendor":"pyload","product":"pyload/pyload","kev":false,"epss":0.00545,"kevAdded":null,"exploit":true},{"id":"CVE-2023-0488","published":"2023-01-26T00:00:00.000Z","updated":"2025-03-31T16:47:00.638Z","title":"Cross-site Scripting (XSS) - Stored in pyload/pyload","severity":"CRITICAL","score":9.6,"vendor":"pyload","product":"pyload/pyload","kev":false,"epss":0.00852,"kevAdded":null,"exploit":true},{"id":"CVE-2023-0435","published":"2023-01-22T00:00:00.000Z","updated":"2025-04-02T15:50:20.297Z","title":"Excessive Attack Surface in pyload/pyload","severity":"MEDIUM","score":4,"vendor":"pyload","product":"pyload/pyload","kev":false,"epss":0.00747,"kevAdded":null,"exploit":true},{"id":"CVE-2023-0434","published":"2023-01-22T00:00:00.000Z","updated":"2025-04-02T15:51:41.649Z","title":"Improper Input Validation in pyload/pyload","severity":"MEDIUM","score":5.4,"vendor":"pyload","product":"pyload/pyload","kev":false,"epss":0.00847,"kevAdded":null,"exploit":true},{"id":"CVE-2023-0297","published":"2023-01-14T00:00:00.000Z","updated":"2025-04-07T18:41:55.800Z","title":"Code Injection in pyload/pyload","severity":"CRITICAL","score":9.8,"vendor":"pyload","product":"pyload/pyload","kev":false,"epss":0.95915,"kevAdded":null,"exploit":true},{"id":"CVE-2023-0227","published":"2023-01-12T00:00:00.000Z","updated":"2025-04-08T13:39:15.554Z","title":"Insufficient Session Expiration in pyload/pyload","severity":"HIGH","score":8.3,"vendor":"pyload","product":"pyload/pyload","kev":false,"epss":0.00674,"kevAdded":null,"exploit":true},{"id":"CVE-2023-0057","published":"2023-01-05T00:00:00.000Z","updated":"2025-04-09T15:33:56.198Z","title":"Improper Restriction of Rendered UI Layers or Frames in pyload/pyload","severity":"LOW","score":3.1,"vendor":"pyload","product":"pyload/pyload","kev":false,"epss":0.005,"kevAdded":null,"exploit":true},{"id":"CVE-2023-0055","published":"2023-01-04T00:00:00.000Z","updated":"2025-04-09T15:32:47.320Z","title":"Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in pyload/pyload","severity":"LOW","score":3.1,"vendor":"pyload","product":"pyload/pyload","kev":false,"epss":0.0047,"kevAdded":null,"exploit":true}]}