Search for packages
| purl | pkg:pypi/pyload-ng@0.5.0b3.dev101 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 4.4 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-8w3f-4r8f-pf53
Aliases: CVE-2025-53890 |
pyLoad vulnerable to XSS through insecure CAPTCHA #### Summary An unsafe JavaScript evaluation vulnerability in pyLoad’s CAPTCHA processing code allows … | There are no reported fixed by versions. |
|
GHSA-3f7w-p8vr-4v5f
Aliases: CVE-2024-32880 |
pyLoad allows upload to arbitrary folder lead to RCE ### Summary An authenticated user can change the download folder and … | There are no reported fixed by versions. |
|
GHSA-4744-96p5-mp2j
Aliases: CVE-2026-35464 |
pyLoad: Unprotected storage_folder enables arbitrary file write to Flask session store and code execution (Incomplete fix for CVE-2026-33509) ## Summary … | There are no reported fixed by versions. |
|
PYSEC-2026-2989
Aliases: CVE-2026-35464 GHSA-4744-96p5-mp2j |
pyLoad: Unprotected storage_folder enables arbitrary file write to Flask session store and code execution (Incomplete fix for CVE-2026-33509) ## Summary … | There are no reported fixed by versions. |
|
PYSEC-2026-492
Aliases: CVE-2024-32880 GHSA-3f7w-p8vr-4v5f |
pyLoad allows upload to arbitrary folder lead to RCE ### Summary An authenticated user can change the download folder and … | There are no reported fixed by versions. |
|
PYSEC-2026-2997
Aliases: CVE-2026-40071 GHSA-rfgh-63mg-8pwm |
pyload-ng has a WebUI JSON permission mismatch that lets ADD/DELETE users invoke MODIFY-only actions ### Summary Several WebUI JSON endpoints … | There are no reported fixed by versions. |
|
PYSEC-2026-496
Aliases: CVE-2025-53890 GHSA-8w3f-4r8f-pf53 |
pyLoad vulnerable to XSS through insecure CAPTCHA #### Summary An unsafe JavaScript evaluation vulnerability in pyLoad’s CAPTCHA processing code allows … | There are no reported fixed by versions. |
|
GHSA-9q47-3cm2-2rp8
|
pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header ## Summary pyLoad determines the "client IP" used for … | There are no reported fixed by versions. |
|
GHSA-fr26-jjhm-638c
|
pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=) ### Summary `UnTar._safe_extractall` — … | There are no reported fixed by versions. |
|
GHSA-jq7h-wrvp-3rgx
|
pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session An admin who revokes … | There are no reported fixed by versions. |
|
GHSA-889w-m37p-88m5
|
pyLoad: Api.set_user_permission never invalidates the target's session ### Summary An admin who revokes or downgrades a non-admin user's permissions through … | There are no reported fixed by versions. |
|
GHSA-68w4-83fh-f2w8
|
pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password ## Summary `Api.getUserData` (legacy) and `Api.get_userdata` … | There are no reported fixed by versions. |
|
GHSA-p3pr-8f3m-4qp8
|
pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host ## Summary pyLoad ships the WindowsPhoneNotify addon, … | There are no reported fixed by versions. |
| Advisory | Summary | Aliases |
|---|---|---|
|
GHSA-r44w-v6gf-x3p6
|
pyLoad has an authentication bypass in API key validation (check_apikey cache) ## Summary The API-key cache in `check_apikey()` allows an … | |
|
PYSEC-2026-4293
|
pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination ## Description: The API `rpc` … |
CVE-2026-48484
GHSA-vq8p-m3wm-gv5f |
|
PYSEC-2026-4292
|
pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo ### … |
CVE-2026-75597
GHSA-j92p-c242-7hfx |