CVE Browser

pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager

pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs

pyLoad: Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory

pyLoad: Stored XSS in Downloads view via unsanitized link URL in packages.js template literal

pyLoad: SSRF via HTTP Redirect Bypass in parse_urls API

pyLoad: Unauthenticated traceback disclosure via global exception handler in WebUI

pyLoad: Path Traversal via Package Folder Name in set_package_data

pyLoad: Path Traversal via Package Folder Name

pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification

pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy

pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)

pyLoad: Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)

pyLoad WebUI JSON permission mismatch lets ADD/DELETE users invoke MODIFY-only actions

pyLoad has an Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix Bypass

Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ng

pyLoad has an incomplete fix for CVE-2026-33509: unprotected storage_folder enables arbitrary file write to Flask session store and code execution

pyLoad has Improper Neutralization of Special Elements used in an OS Command

pyLoad has SSRF fix bypass via HTTP redirect

pyLoad has SSRF in parse_urls API endpoint via unvalidated URL parameter

pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration

pyload-ng: Authentication Bypass via Host Header Injection in ClickNLoad

pyload-ng: SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration

pyload-ng: Improper Authentication and Origin Validation Error

pyLoad: Arbitrary File Deletion via Path Traversal during Encrypted 7z Password Verification

pyLoad: Arbitrary File Write via Path Traversal in edit_package()