Pyload-ng Project
Pyload-ng Project Pyload-ng: vulnerabilidades y CVE
Pyload-ng Project Pyload-ng tiene 20 vulnerabilidades publicadas, 15 de ellas en los últimos 12 meses. 2 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE20
Últimos 12 meses15
Críticas2
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-42315 | Media (6.5) | 0.50% | — | 11 may 2026 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, when passing a folder name in the set_package_data() API function call inside the data object with key "_folder", there is no… |
| CVE-2026-42314 | Media (6.5) | 0.42% | — | 11 may 2026 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, package folder names are sanitized using insufficient string replacement. The pattern ....// becomes .._ after replacement… |
| CVE-2026-42313 | Alta (8.3) | 0.39% | — | 11 may 2026 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_value() API method (@permission(Perms.SETTINGS)) in src/pyload/core/api/__init__.py gates security-sensitive… |
| CVE-2026-42312 | Media (6.8) | 0.19% | — | 11 may 2026 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the set_config_value() API method (@permission(Perms.SETTINGS)) in src/pyload/core/api/__init__.py gates security-sensitive… |
| CVE-2026-40594 | Media (4.8) | 0.16% | — | 21 abr 2026 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev98, the set_session_cookie_secure before_request handler in src/pyload/webui/app/__init__.py reads the X-Forwarded-Proto header… |
| CVE-2026-35592 | Media (6.5) | 0.35% | — | 7 abr 2026 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the _safe_extractall() function in src/pyload/plugins/extractors/UnTar.py uses os.path.commonprefix() for its path traversal… |
| CVE-2026-35586 | Media (6.8) | 0.19% | — | 7 abr 2026 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the ADMIN_ONLY_CORE_OPTIONS authorization set in set_config_value() uses incorrect option names ssl_cert and ssl_key, while… |
| CVE-2026-35463 | Alta (8.8) | 0.91% | — | 7 abr 2026 | pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the ADMIN_ONLY_OPTIONS protection mechanism restricts security-critical configuration values (reconnect scripts, SSL… |
| CVE-2026-35459 | Crítica (9.3) | 0.38% | — | 6 abr 2026 | pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, pyLoad has a server-side request forgery (SSRF) vulnerability. The fix for CVE-2026-33992 added IP validation to… |
| CVE-2026-35187 | Alta (7.7) | 0.36% | — | 6 abr 2026 | pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the parse_urls API function in src/pyload/core/api/__init__.py fetches arbitrary URLs server-side via get_url(url)… |
| CVE-2026-33511 | Alta (8.8) | 0.62% | — | 24 mar 2026 | pyLoad is a free and open-source download manager written in Python. From version 0.4.20 to before version 0.5.0b3.dev97, the local_check decorator in pyLoad's ClickNLoad feature can be bypassed by any remote attacker… |
| CVE-2026-33509 | Alta (8.8) | 0.58% | — | 24 mar 2026 | pyLoad is a free and open-source download manager written in Python. From version 0.4.0 to before version 0.5.0b3.dev97, the set_config_value() API endpoint allows users with the non-admin SETTINGS permission to modify… |
| CVE-2026-33314 | Media (6.5) | 0.18% | — | 24 mar 2026 | pyLoad is a free and open-source download manager written in Python. Prior to version 0.5.0b3.dev97, a Host Header Spoofing vulnerability in the @local_check decorator allows unauthenticated external attackers to bypass… |
| CVE-2026-32808 | Alta (8.1) | 0.46% | — | 20 mar 2026 | pyLoad is a free and open-source download manager written in Python. Versions before 0.5.0b3.dev97 are vulnerable to path traversal during password verification of certain encrypted 7z archives (encrypted files with… |
| CVE-2026-29778 | Media (6.5) | 0.53% | — | 7 mar 2026 | pyLoad is a free and open-source download manager written in Python. From version 0.5.0b3.dev13 to 0.5.0b3.dev96, the edit_package() function implements insufficient sanitization for the pack_folder parameter. The… |
| CVE-2025-54802 | Crítica (9.8) | 1.2% | — | 5 ago 2025 | pyLoad is the free and open-source Download Manager written in pure Python. In versions 0.5.0b3.dev89 and below, there is an opportunity for path traversal in pyLoad-ng CNL Blueprint via package parameter, allowing… |
| CVE-2024-22416 | Alta (8.8) | 0.95% | — | 18 ene 2024 | pyLoad is a free and open-source Download Manager written in pure Python. The `pyload` API allows any API call to be made using GET requests. Since the session cookie is not set to `SameSite: strict`, this opens the… |
| CVE-2023-0509 | Alta (7.4) | 0.53% | — | 26 ene 2023 | Improper Certificate Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev44. |
| CVE-2023-0488 | Media (5.4) | 0.83% | — | 26 ene 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository pyload/pyload prior to 0.5.0b3.dev42. |
| CVE-2023-0057 | Media (6.1) | 0.46% | — | 5 ene 2023 | Improper Restriction of Rendered UI Layers or Frames in GitHub repository pyload/pyload prior to 0.5.0b3.dev33. |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.