Pyload · weakness class
Access Control
7 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
- check available
- 1
Every one of the 7 is a mark on the map. Named now: 1 to 7, most at risk first.
- pyLoad Flask Config - Access Control
- pyload-ng: SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration
- pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy
- Any unauthenticated attacker can bypass the localhost restrictions posed by the application and utilize this to create arbitrary packages
- pyLoad WebUI JSON permission mismatch lets ADD/DELETE users invoke MODIFY-only actions
- pyLoad: Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)
- Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ng
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.