CVE Tools
Track your stack

Pyload-ng

49 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Pyload-ng, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Pyload-ng CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Pyload-ng CVEs per month
MonthCVEs
2024-110
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-074
2025-083
2025-090
2025-101
2025-110
2025-120
2026-010
2026-020
2026-035
2026-049
2026-054
2026-060
2026-070
2026-080
2026-090
2026-107

Severity

How the 49 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical1029%
  • High1337%
  • Medium1234%

Latest CVEs

The 15 most recently published vulnerabilities affecting Pyload-ng.

  1. GHSA-68w4-83fh-f2w8pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password—
  2. GHSA-9q47-3cm2-2rp8pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header—
  3. GHSA-jq7h-wrvp-3rgxpyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session—
  4. GHSA-889w-m37p-88m5pyLoad: Api.set_user_permission never invalidates the target's session—
  5. GHSA-p3pr-8f3m-4qp8pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host—
  6. GHSA-fr26-jjhm-638cpyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)—
  7. GHSA-r44w-v6gf-x3p6pyLoad has an authentication bypass in API key validation (check_apikey cache)—
  8. CVE-2026-42315pyLoad: Path Traversal via Package Folder Name in set_package_data8.1
  9. CVE-2026-42314pyLoad: Path Traversal via Package Folder Name6.5
  10. CVE-2026-42312pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification6.8
  11. CVE-2026-42313pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy8.3
  12. CVE-2026-40594pyLoad: Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)4.8
  13. GHSA-fj52-5g4h-gmq8pyLoad's Session Not Invalidated After Permission Changes—
  14. GHSA-66hx-chf7-3332pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)—
  15. GHSA-rfgh-63mg-8pwmpyload-ng has a WebUI JSON permission mismatch that lets ADD/DELETE users invoke MODIFY-only actions—

Product grouping is registry-driven, with AI assist and human review. How it works