# pyLoad Next Generation vulnerabilities Source: https://junglewise.ai/threats/technologies/pyload-next-generation Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/pyload-next-generation.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 22 vulnerabilities in pyLoad Next Generation: 0 in the last 7 days and 2 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-48987, was published on 15 September 2026. Nothing in the last four weeks, down from 2 vulnerabilities in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 2 - All time: 22 (2 critical, 0 exploited in the wild) ## About pyLoad Next Generation Download manager application for automating file downloads from various online sources. ## Latest pyLoad Next Generation vulnerabilities - [CVE-2026-48987: pyLoad uncontrolled memory growth in EventManager](https://junglewise.ai/threats/cve-2026-48987-pyload-uncontrolled-memory-growth-in-eventmanager) (medium, CVSS 6.5, published 15 Sep 2026) - [CVE-2026-48737: pyLoad pyload-ng SSRF bypass via IPv6 transition wrappers](https://junglewise.ai/threats/cve-2026-48737-pyload-pyload-ng-ssrf-bypass-via-ipv6-transition-wrappers) (medium, CVSS 4.9, published 15 Sep 2026) - [CVE-2026-46561: pyLoad SSRF via HTTP redirect bypass in parse_urls API](https://junglewise.ai/threats/cve-2026-46561-pyload-ssrf-via-http-redirect-bypass-in-parse-urls-api) (medium, CVSS 5, published 28 May 2026) - [CVE-2026-45348: pyLoad stored XSS in Downloads view via packages.js template](https://junglewise.ai/threats/cve-2026-45348-pyload-stored-xss-in-downloads-view-via-packages-js-template) (high, CVSS 8.7, published 28 May 2026) - [CVE-2026-45306: pyLoad account takeover via session directory bypass in storage_folder](https://junglewise.ai/threats/cve-2026-45306-pyload-account-takeover-via-session-directory-bypass-in-storage) (medium, CVSS 6.5, published 28 May 2026) - [CVE-2026-44226: pyLoad pyload-ng information disclosure in WebUI error handler](https://junglewise.ai/threats/cve-2026-44226-pyload-pyload-ng-information-disclosure-in-webui-error-handler) (medium, CVSS 5.3, published 11 May 2026) - [CVE-2026-42315: pyLoad path traversal in set_package_data API](https://junglewise.ai/threats/cve-2026-42315-pyload-path-traversal-in-set-package-data-api) (high, CVSS 8.1, published 11 May 2026) - [CVE-2026-42314: pyLoad path traversal in package folder name sanitization](https://junglewise.ai/threats/cve-2026-42314-pyload-path-traversal-in-package-folder-name-sanitization) (medium, CVSS 6.5, published 11 May 2026) - [CVE-2026-42313: pyLoad incorrect authorization in proxy configuration settings](https://junglewise.ai/threats/cve-2026-42313-pyload-incorrect-authorization-in-proxy-configuration-settings) (high, CVSS 8.3, published 11 May 2026) - [CVE-2026-42312: pyLoad improper authorization allows disabling TLS verification](https://junglewise.ai/threats/cve-2026-42312-pyload-improper-authorization-allows-disabling-tls-verification) (medium, CVSS 6.8, published 11 May 2026) - [CVE-2026-40594: pyLoad session cookie security downgrade via header spoofing](https://junglewise.ai/threats/cve-2026-40594-pyload-session-cookie-security-downgrade-via-header-spoofing) (medium, CVSS 4.8, published 21 Apr 2026) - [CVE-2026-40071: pyload-ng improper authorization in WebUI JSON endpoints](https://junglewise.ai/threats/cve-2026-40071-pyload-ng-improper-authorization-in-webui-json-endpoints) (medium, CVSS 5.4, published 8 Apr 2026) - [CVE-2026-35592: pyload-ng path traversal in UnTar extraction](https://junglewise.ai/threats/cve-2026-35592-pyload-ng-path-traversal-in-untar-extraction) (medium, CVSS 5.3, published 8 Apr 2026) - [CVE-2026-35586: pyload-ng authorization bypass in SSL configuration](https://junglewise.ai/threats/cve-2026-35586-pyload-ng-authorization-bypass-in-ssl-configuration) (medium, CVSS 6.8, published 8 Apr 2026) - [CVE-2026-35187: pyLoad SSRF and local file disclosure in parse_urls API](https://junglewise.ai/threats/cve-2026-35187-pyload-ssrf-and-local-file-disclosure-in-parse-urls-api) (high, CVSS 7.7, published 6 Apr 2026) - [CVE-2026-33314: pyload-ng auth bypass via Host header spoofing in Click'N'Load API](https://junglewise.ai/threats/cve-2026-33314-pyload-ng-auth-bypass-via-host-header-spoofing-in-click-n-load) (medium, CVSS 6.5, published 19 Mar 2026) - [CVE-2026-29778: pyLoad path traversal in edit_package](https://junglewise.ai/threats/cve-2026-29778-pyload-path-traversal-in-edit-package) (high, CVSS 7.1, published 5 Mar 2026) - [CVE-2025-7346: pyLoad authentication bypass via Host header spoofing in local_check](https://junglewise.ai/threats/cve-2025-7346-pyload-authentication-bypass-via-host-header-spoofing-in-local) (high, CVSS 7.5, published 8 Jul 2025) - [pyload-ng localhost restriction bypass allowing arbitrary package creation](https://junglewise.ai/threats/pyload-ng-localhost-restriction-bypass-allowing-arbitrary-package-4cab52ee) (medium, CVSS 4, published 8 Jul 2025) - [pyload-ng RCE via js2py sandbox escape](https://junglewise.ai/threats/pyload-ng-rce-via-js2py-sandbox-escape-6f93210e) (info, CVSS 9.8, published 28 Oct 2024) - [CVE-2024-47821: pyLoad remote code execution via flashgot API and scripts folder manipulation](https://junglewise.ai/threats/cve-2024-47821-pyload-remote-code-execution-via-flashgot-api-and-scripts-folder) (critical, CVSS 9.1, published 28 Oct 2024) - [CVE-2024-22416: pyLoad pyload-ng CSRF leading to admin privilege escalation](https://junglewise.ai/threats/cve-2024-22416-pyload-pyload-ng-csrf-leading-to-admin-privilege-escalation) (critical, CVSS 9.6, published 19 Jan 2024) ## Most severe pyLoad Next Generation vulnerabilities - [CVE-2024-22416: pyLoad pyload-ng CSRF leading to admin privilege escalation](https://junglewise.ai/threats/cve-2024-22416-pyload-pyload-ng-csrf-leading-to-admin-privilege-escalation) (critical, CVSS 9.6, published 19 Jan 2024) - [CVE-2024-47821: pyLoad remote code execution via flashgot API and scripts folder manipulation](https://junglewise.ai/threats/cve-2024-47821-pyload-remote-code-execution-via-flashgot-api-and-scripts-folder) (critical, CVSS 9.1, published 28 Oct 2024) - [CVE-2026-45348: pyLoad stored XSS in Downloads view via packages.js template](https://junglewise.ai/threats/cve-2026-45348-pyload-stored-xss-in-downloads-view-via-packages-js-template) (high, CVSS 8.7, published 28 May 2026) - [CVE-2026-42313: pyLoad incorrect authorization in proxy configuration settings](https://junglewise.ai/threats/cve-2026-42313-pyload-incorrect-authorization-in-proxy-configuration-settings) (high, CVSS 8.3, published 11 May 2026) - [CVE-2026-42315: pyLoad path traversal in set_package_data API](https://junglewise.ai/threats/cve-2026-42315-pyload-path-traversal-in-set-package-data-api) (high, CVSS 8.1, published 11 May 2026) - [CVE-2026-35187: pyLoad SSRF and local file disclosure in parse_urls API](https://junglewise.ai/threats/cve-2026-35187-pyload-ssrf-and-local-file-disclosure-in-parse-urls-api) (high, CVSS 7.7, published 6 Apr 2026) - [CVE-2025-7346: pyLoad authentication bypass via Host header spoofing in local_check](https://junglewise.ai/threats/cve-2025-7346-pyload-authentication-bypass-via-host-header-spoofing-in-local) (high, CVSS 7.5, published 8 Jul 2025) - [CVE-2026-29778: pyLoad path traversal in edit_package](https://junglewise.ai/threats/cve-2026-29778-pyload-path-traversal-in-edit-package) (high, CVSS 7.1, published 5 Mar 2026) - [CVE-2026-42312: pyLoad improper authorization allows disabling TLS verification](https://junglewise.ai/threats/cve-2026-42312-pyload-improper-authorization-allows-disabling-tls-verification) (medium, CVSS 6.8, published 11 May 2026) - [CVE-2026-35586: pyload-ng authorization bypass in SSL configuration](https://junglewise.ai/threats/cve-2026-35586-pyload-ng-authorization-bypass-in-ssl-configuration) (medium, CVSS 6.8, published 8 Apr 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 2 vulnerabilities in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 2 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other pyLoad technologies - [pyLoad](https://junglewise.ai/threats/technologies/pyload): 13 vulnerabilities - [pyLoad Next Gen](https://junglewise.ai/threats/technologies/pyload-next-gen): 7 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "pyLoad Next Generation vulnerabilities", https://junglewise.ai/threats/technologies/pyload-next-generation, 12 November 2026.