Pyload
29 CVEs tracked since 2023. Since Jan 2023, none of them reached CISA KEV.
Pyload CVEs per month
| Month | CVEs | In CISA KEV |
|---|---|---|
| 2023-01 | 8 | 0 |
| 2023-02 | 3 or fewer | |
| 2023-03 | no snapshot | |
| 2023-04 | 3 or fewer | |
| 2023-05 | 3 or fewer | |
| 2023-06 | 4 or fewer | |
| 2023-07 | 3 or fewer | |
| 2023-08 | 4 or fewer | |
| 2023-09 | 3 or fewer | |
| 2023-10 | 4 or fewer | |
| 2023-11 | 4 or fewer | |
| 2023-12 | 4 or fewer | |
| 2024-01 | 4 | 0 |
| 2024-02 | 4 or fewer | |
| 2024-03 | 4 or fewer | |
| 2024-04 | 4 or fewer | |
| 2024-05 | 5 or fewer | |
| 2024-06 | 4 or fewer | |
| 2024-07 | 4 or fewer | |
| 2024-08 | 4 or fewer | |
| 2024-09 | 3 or fewer | |
| 2024-10 | 4 or fewer | |
| 2024-11 | 4 or fewer | |
| 2024-12 | 3 or fewer | |
| 2025-01 | 4 or fewer | |
| 2025-02 | 3 or fewer | |
| 2025-03 | 5 or fewer | |
| 2025-04 | 4 or fewer | |
| 2025-05 | 4 or fewer | |
| 2025-06 | 4 or fewer | |
| 2025-07 | 5 or fewer | |
| 2025-08 | 4 or fewer | |
| 2025-09 | 4 or fewer | |
| 2025-10 | 4 or fewer | |
| 2025-11 | 4 or fewer | |
| 2025-12 | 5 or fewer | |
| 2026-01 | 5 or fewer | |
| 2026-02 | 5 or fewer | |
| 2026-03 | 7 or fewer | |
| 2026-04 | 9 | 0 |
| 2026-05 | 8 | 0 |
| 2026-06 | 7 or fewer | |
| 2026-07 | 7 or fewer | |
| 2026-08 | 8 or fewer | |
| 2026-09 | 9 or fewer | |
| 2026-10 | 6 or fewer |
Products
The products that kept showing up in Pyload's monthly top three, with their CVEs summed over those months.
Latest CVEs
The 15 most recently published vulnerabilities affecting Pyload.
- CVE-2026-75597pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo5.3
- CVE-2026-48484pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination6.5
- CVE-2026-48987pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager6.5
- CVE-2026-48737pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs4.9
- CVE-2026-45306pyLoad: Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory6.5
- CVE-2026-45348pyLoad: Stored XSS in Downloads view via unsanitized link URL in packages.js template literal8.7
- CVE-2026-46561pyLoad: SSRF via HTTP Redirect Bypass in parse_urls API5.0
- CVE-2026-44226pyLoad: Unauthenticated traceback disclosure via global exception handler in WebUI5.3
- CVE-2026-42315pyLoad: Path Traversal via Package Folder Name in set_package_data8.1
- CVE-2026-42314pyLoad: Path Traversal via Package Folder Name6.5
- CVE-2026-42312pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification6.8
- CVE-2026-42313pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy8.3
- CVE-2026-41133pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)8.8
- CVE-2026-40594pyLoad: Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)4.8
- CVE-2026-40071pyLoad WebUI JSON permission mismatch lets ADD/DELETE users invoke MODIFY-only actions5.4
The record
- Peak rank
- #75 in Jan 2023
- Busiest month shown
- Apr 2026, 9 CVEs
- Months with a KEV entry
- 0 since Jan 2023
- Monthly snapshots
- 4 since 2023