CVE-2026-48987pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager Exploitation status Public exploit Fix Affected product P pyload Published 09/15/2026 Severity Medium CVE-2026-48737pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs Exploitation status Public exploit Fix Affected product P pyload Published 09/15/2026 Severity Medium CVE-2026-45306pyLoad: Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory Exploitation status Public exploit Fix Affected product P pyload Published 05/28/2026 Severity Medium CVE-2026-45348pyLoad: Stored XSS in Downloads view via unsanitized link URL in packages.js template literal Exploitation status Not known exploited Fix Affected product P pyload Published 05/28/2026 Severity High CVE-2026-46561pyLoad: SSRF via HTTP Redirect Bypass in parse_urls API Exploitation status Public exploit Fix Affected product P pyload Published 05/28/2026 Severity Medium CVE-2026-44226pyLoad: Unauthenticated traceback disclosure via global exception handler in WebUI Exploitation status Public exploit Fix Affected product P pyload Published 05/11/2026 Severity Medium CVE-2026-42315pyLoad: Path Traversal via Package Folder Name in set_package_data Exploitation status Public exploit Fix Affected product P pyload Published 05/11/2026 Severity High CVE-2026-42314pyLoad: Path Traversal via Package Folder Name Exploitation status Public exploit Fix Affected product P pyload Published 05/11/2026 Severity Medium CVE-2026-42312pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification Exploitation status Public exploit Fix Affected product P pyload Published 05/11/2026 Severity Medium CVE-2026-42313pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy Exploitation status Public exploit Fix Affected product P pyload Published 05/11/2026 Severity High CVE-2026-41133pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass) Exploitation status Public exploit Fix Affected product P pyload Published 04/21/2026 Severity High CVE-2026-40594pyLoad: Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition) Exploitation status Public exploit Fix Affected product P pyload Published 04/21/2026 Severity Medium CVE-2026-40071pyLoad WebUI JSON permission mismatch lets ADD/DELETE users invoke MODIFY-only actions Exploitation status Public exploit Fix Affected product P pyload Published 04/09/2026 Severity Medium CVE-2026-35592pyLoad has an Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix Bypass Exploitation status Public exploit Fix Affected product P pyload Published 04/07/2026 Severity Medium CVE-2026-35586Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ng Exploitation status Public exploit Fix Affected product P pyload Published 04/07/2026 Severity Medium CVE-2026-35464pyLoad has an incomplete fix for CVE-2026-33509: unprotected storage_folder enables arbitrary file write to Flask session store and code execution Exploitation status Public exploit Fix Not confirmed Affected product P pyload Published 04/07/2026 Severity High CVE-2026-35463pyLoad has Improper Neutralization of Special Elements used in an OS Command Exploitation status Public exploit Fix Not confirmed Affected product P pyload Published 04/07/2026 Severity High CVE-2026-35459pyLoad has SSRF fix bypass via HTTP redirect Exploitation status Public exploit Fix Not confirmed Affected product P pyload Published 04/06/2026 Severity Critical CVE-2026-35187pyLoad has SSRF in parse_urls API endpoint via unvalidated URL parameter Exploitation status Public exploit Fix Not confirmed Affected product P pyload Published 04/06/2026 Severity High CVE-2026-33992pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration Exploitation status Public exploit Fix Not confirmed Affected product P pyload Published 03/27/2026 Severity Critical CVE-2026-33511pyload-ng: Authentication Bypass via Host Header Injection in ClickNLoad Exploitation status Public exploit Fix Affected product P pyload Published 03/24/2026 Severity High CVE-2026-33509pyload-ng: SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration Exploitation status Public exploit Fix Affected product P pyload Published 03/24/2026 Severity High CVE-2026-33314pyload-ng: Improper Authentication and Origin Validation Error Exploitation status Public exploit Fix Affected product P pyload Published 03/24/2026 Severity Medium CVE-2026-32808pyLoad: Arbitrary File Deletion via Path Traversal during Encrypted 7z Password Verification Exploitation status Public exploit Fix Affected product P pyload Published 03/20/2026 Severity High CVE-2026-29778pyLoad: Arbitrary File Write via Path Traversal in edit_package() Exploitation status Public exploit Fix Affected product P pyload Published 03/07/2026 Severity High CVE-2025-61773pyLoad CNL and captcha handlers allow code Injection via unsanitized parameters Exploitation status Public exploit Fix Not confirmed Affected product P pyload Published 10/09/2025 Severity High CVE-2025-57751Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs Exploitation status Public exploit Fix Affected product P pyload Published 08/21/2025 Severity High CVE-2025-55156PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameter Exploitation status Public exploit Fix Affected product P pyload Published 08/11/2025 Severity High CVE-2025-54802pyLoad CNL Blueprint is vulnerable to Path Traversal through `dlc_path` leading to Remote Code Execution (RCE) Exploitation status Public exploit Fix Affected product P pyload Published 08/05/2025 Severity Critical CVE-2025-54140pyLoad has Path Traversal Vulnerability in json/upload Endpoint that allows Arbitrary File Write Exploitation status Public exploit Fix Affected product P pyload Published 07/22/2025 Severity High CVE-2025-53890pyLoad vulnerable to remote code execution through js2py onCaptchaResult Exploitation status Public exploit Fix Not confirmed Affected product P pyload Published 07/14/2025 Severity Critical CVE-2025-7346Exploitation status Public exploit Fix Not confirmed Affected product P pyload Published 07/08/2025 Severity High CVE-2024-1240Open Redirection in pyload/pyload Exploitation status Public exploit Fix Affected product P pyload/pyload Published 11/15/2024 Severity Medium CVE-2024-47821pyLoad vulnerable to remote code execution by download to /.pyload/scripts using /flashgot API Exploitation status Public exploit Fix Not confirmed Affected product P pyload Published 10/25/2024 Severity Critical CVE-2024-32880pyLoad allows upload to arbitrary folder lead to RCE Exploitation status Not known exploited Fix Affected product P pyload Published 04/26/2024 Severity Critical CVE-2024-24808pyLoad open redirect vulnerability due to improper validation of the is_safe_url function Exploitation status Public exploit Fix Not confirmed Affected product P pyload Published 02/06/2024 Severity Medium CVE-2024-22416Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation Exploitation status Not known exploited Fix Not confirmed Affected product P pyload Published 01/17/2024 Severity Critical CVE-2024-21644pyLoad unauthenticated flask configuration leakage Exploitation status Public exploit Fix Affected product P pyload Published 01/08/2024 Severity High CVE-2024-21645pyLoad Log Injection Exploitation status Public exploit Fix Affected product P pyload Published 01/08/2024 Severity Medium CVE-2023-47890Exploitation status Public exploit Fix Not confirmed Affected product Not confirmed Published 01/08/2024 Severity High CVE-2023-0488Cross-site Scripting (XSS) - Stored in pyload/pyload Exploitation status Public exploit Fix Affected product P pyload/pyload Published 01/26/2023 Severity Critical CVE-2023-0509Improper Certificate Validation in pyload/pyload Exploitation status Public exploit Fix Affected product P pyload/pyload Published 01/26/2023 Severity High CVE-2023-0434Improper Input Validation in pyload/pyload Exploitation status Public exploit Fix Affected product P pyload/pyload Published 01/22/2023 Severity Medium CVE-2023-0435Excessive Attack Surface in pyload/pyload Exploitation status Public exploit Fix Affected product P pyload/pyload Published 01/22/2023 Severity Medium CVE-2023-0297Code Injection in pyload/pyload Exploitation status Public exploit Fix Affected product P pyload/pyload Published 01/14/2023 Severity Critical CVE-2023-0227Insufficient Session Expiration in pyload/pyload Exploitation status Public exploit Fix Affected product P pyload/pyload Published 01/12/2023 Severity High CVE-2023-0057Improper Restriction of Rendered UI Layers or Frames in pyload/pyload Exploitation status Public exploit Fix Affected product P pyload/pyload Published 01/05/2023 Severity Low CVE-2023-0055Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in pyload/pyload Exploitation status Public exploit Fix Affected product P pyload/pyload Published 01/04/2023 Severity Low 
