VulertSecurity VulertSecurity

Vulnerability Database · PyPI · pyload-ng · Version

pyload-ng 0.5.0b3.dev95

0.5.0b3.dev95 is affected by 69 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to.

Critical 10 High 25 Medium 32 Low 2 Unrated 0

All pyload-ng versions & vulnerabilities → Source repository Search the database for this package →
Released 31 Jan 2026 Licence AGPL-3.0 Also known from other sources 61 Newer releases 106 Database updated 23/Oct/2026

Release and licence data published by PyPI. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

pyload-ng 0.5.0b3.dev95 vulnerabilities

69 vulnerabilities cover pyload-ng 0.5.0b3.dev95. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2024-39205: pyload-ng Remote Code Execution Vulnerability Due to js2py Sandbox Escape 9.8 critical No fix published 29 Jun 2026
CVE-2025-53890: pyLoad XSS Vulnerability in CAPTCHA Processing 9.8 critical 0.20 29 Jun 2026
CVE-2025-53890: pyLoad Vulnerable to XSS through Insecure CAPTCHA Processing 9.8 critical 0.20 15 Jul 2025
pyload-ng Vulnerability: RCE with js2py Sandbox Escape 9.8 critical No fix published 09 Sep 2024
CVE-2026-35459: pyload-ng SSRF Filter Bypass via HTTP Redirect 9.3 critical No fix published 29 Jun 2026
CVE-2026-33992: pyLoad Server-Side Request Forgery Vulnerability Exposes Cloud Metadata 9.3 critical No fix published 29 Jun 2026
CVE-2026-35459: pyload-ng SSRF Filter Bypass via HTTP Redirect 9.3 critical No fix published 04 Apr 2026
CVE-2026-33992: pyLoad Server-Side Request Forgery Vulnerability Exposes Cloud Metadata 9.3 critical No fix published 27 Mar 2026
CVE-2024-32880: pyLoad Remote Code Execution via Arbitrary File Upload 9.1 critical No fix published 29 Jun 2026
CVE-2024-32880: pyload-ng allows upload to arbitrary folder lead to RCE 9.1 critical No fix published 24 Apr 2024
CVE-2026-41133: pyLoad Privilege Revocation Bypass Due to Stale Session Handling 8.8 high No fix published 13 Jul 2026
Stale Session Privilege Bypass in pyLoad: A Critical Authorization Flaw 8.8 high No fix published 14 Apr 2026
CVE-2026-35463: pyLoad Remote Code Execution Vulnerability Due to Inadequate Plugin Configuration Security 8.8 high 0.5.0b3.dev97 07 Apr 2026
CVE-2026-35463: pyLoad Remote Code Execution via Improper Plugin Configuration 8.8 high No fix published 04 Apr 2026
CVE-2024-22416: pyload-ng - Cross-Site Request Forgery (CSRF) Vulnerability 8.8 high 1374c824271cb7e927740664d06d2e577624ca3e 18 Jan 2024
CVE-2026-45348: pyLoad Stored XSS Vulnerability in Downloads View 8.7 high No fix published 13 Jul 2026
CVE-2026-45348: pyLoad Stored XSS Vulnerability in Downloads View 8.7 high No fix published 14 May 2026
CVE-2026-42313: pyLoad Proxy Configuration Vulnerability Allows Unauthorized Access 8.3 high 0.5.0b3.dev100 11 May 2026
CVE-2026-42313: pyload-ng Proxy Configuration Vulnerability Allows Traffic Redirection 8.3 high 0.5.0b3.dev100 04 May 2026
Brute Force Vulnerability in pyload-ng: Exposed User Data Access 8.1 high No fix published 09 Oct 2026
Critical Authentication Bypass in pyLoad due to API Key Cache Vulnerability 8.1 high 0.5.0b3.dev101 09 Oct 2026
CVE-2026-42315: PyLoad Path Traversal Vulnerability via Package Folder Name 8.1 high 0.5.0b3.dev100 05 May 2026
Critical Vulnerability in pyLoad: Device Node and FIFO Creation via Tar Extraction 7.7 high No fix published 09 Oct 2026
CVE-2026-35187: pyload-ng SSRF Vulnerability in parse_urls API Endpoint 7.7 high No fix published 13 Jul 2026
CVE-2026-35187: pyLoad SSRF Vulnerability in parse_urls API Endpoint 7.7 high No fix published 04 Apr 2026
Privilege Revocation and Session Invalidation Issue in pyLoad: A Security Concern 7.5 high No fix published 09 Oct 2026
CVE-2026-35464: pyLoad Arbitrary File Write and Code Execution Vulnerability 7.5 high No fix published 13 Jul 2026
CVE-2026-33509: pyLoad Remote Code Execution via Unrestricted Reconnect Script Configuration 7.5 high No fix published 13 Jul 2026
CVE-2025-7346: pyLoad Localhost Restriction Bypass Vulnerability 7.5 high No fix published 07 Jul 2026
CVE-2026-35464: pyLoad Arbitrary File Write and Code Execution Vulnerability 7.5 high No fix published 04 Apr 2026
CVE-2026-33509: pyLoad Remote Code Execution via Unrestricted Reconnect Script Configuration 7.5 high No fix published 20 Mar 2026
CVE-2025-7346: pyload-ng Vulnerability Allows Unauthenticated Package Creation 7.5 high No fix published 08 Jul 2025
CVE-2026-29778: pyLoad Arbitrary File Write via Path Traversal in edit_package() 7.1 high No fix published 05 Mar 2026
Rate-Limit Bypass and Audit-Log Spoofing in pyLoad: A Security Concern 6.9 medium No fix published 09 Oct 2026
CVE-2026-42312: pyload-ng SSL Verification Bypass Vulnerability 6.8 medium 0.5.0b3.dev100 11 May 2026
CVE-2026-42312: pyload-ng Vulnerability Allows Non-Admin Users to Disable TLS Verification 6.8 medium 0.5.0b3.dev100 04 May 2026
CVE-2026-35586: pyload-ng Authorization Bypass for SSL Certificate/Key Configuration 6.8 medium 0.5.0b3.dev97 08 Apr 2026
CVE-2026-35586: pyLoad Vulnerability Allows Unauthorized SSL Configuration Changes 6.8 medium 0.5.0b3.dev97 07 Apr 2026
CVE-2026-48484: pyLoad Denial of Service Vulnerability Due to Lack of Input Size Validation 6.5 medium 0.5.0b3.dev101 15 Oct 2026
CVE-2026-48484: pyLoad Denial of Service Vulnerability Due to Lack of Input Size Validation 6.5 medium 0.5.0b3.dev101 09 Oct 2026
CVE-2026-48987: pyLoad Unbounded Memory Growth Leading to DoS and Potential DDoS 6.5 medium No fix published 13 Jul 2026
CVE-2026-45306: pyLoad Incomplete Fix for Storage Folder Bypass Vulnerability 6.5 medium No fix published 13 Jul 2026
CVE-2026-48987: pyLoad Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager 6.5 medium No fix published 09 Jul 2026
CVE-2026-45306: pyLoad Incomplete Fix for Storage Folder Bypass Vulnerability 6.5 medium No fix published 14 May 2026
CVE-2026-42314: pyload-ng Insufficient String Replacement Vulnerability 6.5 medium 0.5.0b3.dev100 11 May 2026
CVE-2026-42315: pyload-ng Arbitrary Directory Vulnerability in set_package_data() API 6.5 medium 0.5.0b3.dev100 11 May 2026
CVE-2026-42314: PyLoad Path Traversal Vulnerability in Package Folder Name 6.5 medium 0.5.0b3.dev100 05 May 2026
CVE-2026-35592: pyLoad Path Traversal Vulnerability in UnTar Plugin 6.5 medium 0.5.0b3.dev97 07 Apr 2026
CVE-2026-33314: pyload-ng Host Header Spoofing Vulnerability Leading to SSRF and DoS 6.5 medium 0.5.0b3.dev97 24 Mar 2026
CVE-2026-33314: pyload-ng Host Header Spoofing Vulnerability Leading to SSRF and DoS 6.5 medium 0.5.0b3.dev97 19 Mar 2026
CVE-2026-29778: pyLoad Insufficient Sanitization in edit_package() Function 6.5 medium 0.5.0b3.dev97 07 Mar 2026
SSRF Vulnerability in pyLoad WindowsPhoneNotify Addon: Unrestricted HTTP Connections 6.4 medium No fix published 09 Oct 2026
CVE-2026-40071: pyload-ng WebUI JSON Permission Mismatch Allows Unauthorized Modify Actions 5.4 medium No fix published 13 Jul 2026
Permission Bypass Vulnerability in pyload-ng: Unauthorized Access to Modify Actions 5.4 medium No fix published 08 Apr 2026
CVE-2026-75597: pyLoad Unauthenticated Access to Sensitive Templates and Internal Error Details Leakage 5.3 medium 0.5.0b3.dev101 15 Oct 2026
CVE-2026-75597: pyLoad Unauthenticated Access to Sensitive Templates and Internal Error Details Leakage 5.3 medium 0.5.0b3.dev101 09 Oct 2026
CVE-2026-44226: PyLoad Unauthenticated Traceback Disclosure in WebUI 5.3 medium 0.5.0b3.dev100 13 Jul 2026
CVE-2026-44226: PyLoad Unauthenticated Traceback Disclosure in WebUI 5.3 medium 0.5.0b3.dev100 06 May 2026
CVE-2026-35592: pyload-ng Incomplete Tar Path Traversal Fix in UnTar._safe_extractall 5.3 medium 0.5.0b3.dev97 08 Apr 2026
CVE-2026-46561: pyload-ng SSRF via HTTP Redirect Bypass in parse_urls API 5.0 medium 0.5.0b3.dev100 13 Jul 2026
CVE-2026-46561: pyload-ng SSRF via HTTP Redirect Bypass in parse_urls API 5.0 medium 0.5.0b3.dev100 21 May 2026
CVE-2026-48737: pyLoad SSRF Guard Bypass via IPv6 Transition Wrappers 4.9 medium No fix published 13 Jul 2026
CVE-2026-48737: pyLoad SSRF Guard Bypass via IPv6 Transition Wrappers 4.9 medium No fix published 09 Jul 2026
CVE-2026-40594: pyLoad Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing 4.8 medium 0.5.0b3.dev98 16 Apr 2026
Log Injection Vulnerability in Pyload-ng: Arbitrary Log Entry Injection via API 4.3 medium No fix published 30 Jul 2025
Session Management Flaw in pyLoad: Inadequate Invalidations After Permission Changes 2.9 low No fix published 14 Apr 2026
CVE-2024-47821: pyload-ng Remote Code Execution Vulnerability Due to Insecure Script Handling 2.3 low No fix published 25 Oct 2024
Unauthorized Access Vulnerability in pyload-ng: Bypass of Localhost Restrictions N/A high No fix published 08 Jul 2025
Remote Code Execution Vulnerability in pyload-ng: Duplicate Advisory GHSA-25pw-q952-x37g N/A high No fix published 28 Oct 2024

Looking for another version, or everything Vulert holds for pyload-ng?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About pyload-ng 0.5.0b3.dev95

Is pyload-ng 0.5.0b3.dev95 vulnerable?

Yes. 69 vulnerabilities in the Vulert database cover pyload-ng 0.5.0b3.dev95: 10 critical, 25 high, 32 medium and 2 low. Each entry above names the fixed version to move to.

Is 0.5.0b3.dev95 the latest release of pyload-ng?

No. 0.5.0b3.dev95 was published 31 Jan 2026, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor pyload-ng for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the pyload-ng version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.