{"schema_version":1,"title":"pyload-ng (PyPI) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 47 vulnerabilities in pyload-ng (PyPI): 0 in the last 7 days and 23 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-48987, was published on 15 September 2026.","url":"https://junglewise.ai/threats/technologies/pyload-ng","json_url":"https://junglewise.ai/threats/technologies/pyload-ng.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/pyload-ng","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":8,"all_time":47,"critical":3,"exploited":0,"last_7_days":0,"last_30_days":2,"last_90_days":23,"last_365_days":43},"latest":[{"cve":"CVE-2026-48987","cvss":6.5,"epss":0.0044,"slug":"cve-2026-48987-pyload-uncontrolled-memory-growth-in-eventmanager","title":"pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, EventManager in src/pyload/core/managers/event","severity":"medium","exploited":false,"published_at":"2026-09-15T15:17:16.397+00:00","url":"https://junglewise.ai/threats/cve-2026-48987-pyload-uncontrolled-memory-growth-in-eventmanager"},{"cve":"CVE-2026-48737","cvss":4.9,"epss":0.0029,"slug":"cve-2026-48737-pyload-pyload-ng-ssrf-bypass-via-ipv6-transition-wrappers","title":"pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, is_global_address in src/pyload/core/utils/web","severity":"medium","exploited":false,"published_at":"2026-09-15T15:17:16.22+00:00","url":"https://junglewise.ai/threats/cve-2026-48737-pyload-pyload-ng-ssrf-bypass-via-ipv6-transition-wrappers"},{"cve":"CVE-2026-35464","cvss":3.1,"epss":0.0061,"slug":"cve-2026-35464-pyload-unprotected-storage-folder-enables-arbitrary-file-write-to","title":"PYSEC-2026-2989 - pyLoad: Unprotected storage_folder enables arbitrary file write to Flask session store and code execution (Incomplete fix for","severity":"low","exploited":false,"published_at":"2026-07-13T14:36:48.066256+00:00","url":"https://junglewise.ai/threats/cve-2026-35464-pyload-unprotected-storage-folder-enables-arbitrary-file-write-to"},{"cve":"CVE-2026-33509","cvss":3.1,"epss":0.0058,"slug":"cve-2026-33509-pyload-settings-permission-users-can-achieve-remote-code","title":"PYSEC-2026-2996 - pyLoad SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration","severity":"low","exploited":false,"published_at":"2026-07-13T14:36:44.126156+00:00","url":"https://junglewise.ai/threats/cve-2026-33509-pyload-settings-permission-users-can-achieve-remote-code"},{"cve":"CVE-2025-57751","cvss":4,"epss":0.0033,"slug":"cve-2025-57751-denial-of-service-attack-in-pyload-cnl-blueprint-using-dukpy","title":"PYSEC-2026-1815 - Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs","severity":"medium","exploited":false,"published_at":"2026-07-07T16:03:01.699516+00:00","url":"https://junglewise.ai/threats/cve-2025-57751-denial-of-service-attack-in-pyload-cnl-blueprint-using-dukpy"},{"cve":"CVE-2025-55156","cvss":4,"epss":0.0033,"slug":"cve-2025-55156-pyload-vulnerable-to-sql-injection-via-api-json-add-package-in","title":"PYSEC-2026-1821 - PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameter","severity":"medium","exploited":false,"published_at":"2026-07-07T16:03:00.874481+00:00","url":"https://junglewise.ai/threats/cve-2025-55156-pyload-vulnerable-to-sql-injection-via-api-json-add-package-in"},{"cve":"CVE-2025-54140","cvss":3.1,"epss":0.0065,"slug":"cve-2025-54140-pyload-has-path-traversal-vulnerability-in-json-upload-endpoint","title":"PYSEC-2026-1823 - `pyLoad` has Path Traversal Vulnerability in `json/upload` Endpoint that allows Arbitrary File Write","severity":"low","exploited":false,"published_at":"2026-07-07T16:02:58.163161+00:00","url":"https://junglewise.ai/threats/cve-2025-54140-pyload-has-path-traversal-vulnerability-in-json-upload-endpoint"},{"cve":"CVE-2024-24808","cvss":3.1,"epss":0.0055,"slug":"cve-2024-24808-pyload-open-redirect-vulnerability-due-to-improper-validation-of","title":"PYSEC-2026-1817 - pyLoad open redirect vulnerability due to improper validation of the is_safe_url function","severity":"low","exploited":false,"published_at":"2026-07-07T11:45:32.146458+00:00","url":"https://junglewise.ai/threats/cve-2024-24808-pyload-open-redirect-vulnerability-due-to-improper-validation-of"},{"cve":"CVE-2024-21644","cvss":3.1,"epss":0.4244,"slug":"cve-2024-21644-pyload-unauthenticated-flask-configuration-leakage-vulnerability","title":"PYSEC-2026-1820 - pyload Unauthenticated Flask Configuration Leakage vulnerability","severity":"low","exploited":false,"published_at":"2026-07-07T11:45:29.730451+00:00","url":"https://junglewise.ai/threats/cve-2024-21644-pyload-unauthenticated-flask-configuration-leakage-vulnerability"},{"cve":"CVE-2024-21645","cvss":3.1,"epss":0.247,"slug":"cve-2024-21645-pyload-log-injection-vulnerability","title":"PYSEC-2026-1818 - pyload Log Injection vulnerability","severity":"low","exploited":false,"published_at":"2026-07-07T11:45:29.653767+00:00","url":"https://junglewise.ai/threats/cve-2024-21645-pyload-log-injection-vulnerability"},{"cve":"CVE-2023-47890","cvss":3.1,"epss":0.0106,"slug":"cve-2023-47890-download-to-arbitrary-folder-can-lead-to-rce","title":"PYSEC-2026-1819 - Download to arbitrary folder can lead to RCE","severity":"low","exploited":false,"published_at":"2026-07-07T11:45:27.551381+00:00","url":"https://junglewise.ai/threats/cve-2023-47890-download-to-arbitrary-folder-can-lead-to-rce"},{"cve":"CVE-2023-0488","cvss":3.1,"epss":0.0083,"slug":"cve-2023-0488-cross-site-scripting-in-pyload-ng","title":"PYSEC-2026-907 - Cross-site Scripting in pyload-ng","severity":"low","exploited":false,"published_at":"2026-07-07T10:17:27.25679+00:00","url":"https://junglewise.ai/threats/cve-2023-0488-cross-site-scripting-in-pyload-ng"},{"cve":"CVE-2023-0509","cvss":3,"epss":0.0053,"slug":"cve-2023-0509-improper-certificate-validation-in-pyload-ng","title":"PYSEC-2026-903 - Improper Certificate Validation in pyload-ng","severity":"low","exploited":false,"published_at":"2026-07-07T10:17:27.200793+00:00","url":"https://junglewise.ai/threats/cve-2023-0509-improper-certificate-validation-in-pyload-ng"},{"cve":"CVE-2023-0434","cvss":3,"epss":0.0082,"slug":"cve-2023-0434-improper-input-validation-in-pyload-ng","title":"PYSEC-2026-908 - Improper Input Validation in pyload-ng","severity":"low","exploited":false,"published_at":"2026-07-07T10:17:27.05953+00:00","url":"https://junglewise.ai/threats/cve-2023-0434-improper-input-validation-in-pyload-ng"},{"cve":"CVE-2023-0227","cvss":3.1,"epss":0.0066,"slug":"cve-2023-0227-pyload-insufficient-session-expiration-vulnerability","title":"PYSEC-2026-906 - Pyload Insufficient Session Expiration vulnerability","severity":"low","exploited":false,"published_at":"2026-07-07T10:17:26.498867+00:00","url":"https://junglewise.ai/threats/cve-2023-0227-pyload-insufficient-session-expiration-vulnerability"},{"cve":"CVE-2023-0057","cvss":3.1,"epss":0.0046,"slug":"cve-2023-0057-pyload-vulnerable-to-improper-restriction-of-rendered-ui-layers-or","title":"PYSEC-2026-904 - pyLoad vulnerable to Improper Restriction of Rendered UI Layers or Frames","severity":"low","exploited":false,"published_at":"2026-07-07T10:17:26.317263+00:00","url":"https://junglewise.ai/threats/cve-2023-0057-pyload-vulnerable-to-improper-restriction-of-rendered-ui-layers-or"},{"cve":"CVE-2023-0055","cvss":3.1,"epss":0.0044,"slug":"cve-2023-0055-pyload-contains-sensitive-cookie-in-https-session-without-secure","title":"PYSEC-2026-905 - Pyload contains Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","severity":"low","exploited":false,"published_at":"2026-07-07T10:17:26.264021+00:00","url":"https://junglewise.ai/threats/cve-2023-0055-pyload-contains-sensitive-cookie-in-https-session-without-secure"},{"cve":"CVE-2026-33992","cvss":4,"epss":0.0045,"slug":"cve-2026-33992-pyload-server-side-request-forgery-via-download-link-submission","title":"PYSEC-2026-497 - pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration","severity":"medium","exploited":false,"published_at":"2026-06-29T11:50:45.126569+00:00","url":"https://junglewise.ai/threats/cve-2026-33992-pyload-server-side-request-forgery-via-download-link-submission"},{"cve":"CVE-2023-0435","cvss":3.1,"epss":0.0073,"slug":"cve-2023-0435-excessive-attack-surface-in-pyload-ng","title":"PYSEC-2026-494 - Excessive Attack Surface in pyload-ng","severity":"low","exploited":false,"published_at":"2026-06-29T11:50:44.253043+00:00","url":"https://junglewise.ai/threats/cve-2023-0435-excessive-attack-surface-in-pyload-ng"},{"cve":"CVE-2023-0297","cvss":3.1,"epss":0.9592,"slug":"cve-2023-0297-code-injection-in-pyload-ng","title":"PYSEC-2026-498 - Code Injection in pyload-ng","severity":"low","exploited":false,"published_at":"2026-06-29T11:50:44.189733+00:00","url":"https://junglewise.ai/threats/cve-2023-0297-code-injection-in-pyload-ng"},{"cve":"CVE-2024-39205","cvss":3.1,"epss":0.1654,"slug":"cve-2024-39205-pyload-ng-vulnerable-to-rce-with-js2py-sandbox-escape","title":"PYSEC-2026-499 - pyload-ng vulnerable to RCE with js2py sandbox escape","severity":"low","exploited":false,"published_at":"2026-06-29T11:50:40.987839+00:00","url":"https://junglewise.ai/threats/cve-2024-39205-pyload-ng-vulnerable-to-rce-with-js2py-sandbox-escape"},{"cve":"CVE-2025-54802","cvss":3.1,"epss":0.0119,"slug":"cve-2025-54802-pyload-cnl-blueprint-allows-path-traversal-through-dlc-path-which","title":"PYSEC-2026-493 - pyLoad CNL Blueprint allows Path Traversal through `dlc_path` which leads to Remote Code Execution (RCE)","severity":"low","exploited":false,"published_at":"2026-06-29T11:50:38.024281+00:00","url":"https://junglewise.ai/threats/cve-2025-54802-pyload-cnl-blueprint-allows-path-traversal-through-dlc-path-which"},{"cve":"CVE-2025-53890","cvss":3.1,"epss":0.0116,"slug":"cve-2025-53890-pyload-vulnerable-to-xss-through-insecure-captcha","title":"PYSEC-2026-496 - pyLoad vulnerable to XSS through insecure CAPTCHA","severity":"low","exploited":false,"published_at":"2026-06-29T11:50:37.278367+00:00","url":"https://junglewise.ai/threats/cve-2025-53890-pyload-vulnerable-to-xss-through-insecure-captcha"},{"cve":"CVE-2026-46561","cvss":5,"epss":0.0029,"slug":"cve-2026-46561-pyload-ssrf-via-http-redirect-bypass-in-parse-urls-api","title":"pyLoad SSRF via HTTP redirect bypass in parse_urls API","severity":"medium","exploited":false,"published_at":"2026-05-28T18:16:36.123+00:00","url":"https://junglewise.ai/threats/cve-2026-46561-pyload-ssrf-via-http-redirect-bypass-in-parse-urls-api"},{"cve":"CVE-2026-45348","cvss":8.7,"epss":0.0035,"slug":"cve-2026-45348-pyload-stored-xss-in-downloads-view-via-packages-js-template","title":"pyLoad stored XSS in Downloads view via packages.js template","severity":"high","exploited":false,"published_at":"2026-05-28T18:16:35.437+00:00","url":"https://junglewise.ai/threats/cve-2026-45348-pyload-stored-xss-in-downloads-view-via-packages-js-template"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":6},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":13},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"open-webui (PyPI)","slug":"open-webui","vulnerabilities":156,"url":"https://junglewise.ai/threats/technologies/open-webui"},{"name":"nltk (PyPI)","slug":"nltk","vulnerabilities":74,"url":"https://junglewise.ai/threats/technologies/nltk"},{"name":"picklescan (PyPI)","slug":"picklescan","vulnerabilities":74,"url":"https://junglewise.ai/threats/technologies/picklescan"},{"name":"openbabel (PyPI)","slug":"openbabel","vulnerabilities":48,"url":"https://junglewise.ai/threats/technologies/openbabel"},{"name":"apache-superset (PyPI)","slug":"apache-superset","vulnerabilities":44,"url":"https://junglewise.ai/threats/technologies/apache-superset"},{"name":"apache-airflow (PyPI)","slug":"apache-airflow","vulnerabilities":40,"url":"https://junglewise.ai/threats/technologies/apache-airflow"},{"name":"tensorflow-gpu (PyPI)","slug":"tensorflow-gpu","vulnerabilities":37,"url":"https://junglewise.ai/threats/technologies/tensorflow-gpu"},{"name":"tensorflow-cpu (PyPI)","slug":"tensorflow-cpu","vulnerabilities":34,"url":"https://junglewise.ai/threats/technologies/tensorflow-cpu"},{"name":"weblate (PyPI)","slug":"weblate","vulnerabilities":33,"url":"https://junglewise.ai/threats/technologies/weblate"},{"name":"mcp-atlassian (PyPI)","slug":"mcp-atlassian","vulnerabilities":30,"url":"https://junglewise.ai/threats/technologies/mcp-atlassian"},{"name":"crawl4ai (PyPI)","slug":"crawl4ai","vulnerabilities":28,"url":"https://junglewise.ai/threats/technologies/crawl4ai"},{"name":"moin (PyPI)","slug":"moin","vulnerabilities":28,"url":"https://junglewise.ai/threats/technologies/moin"}],"technology":{"hub":true,"name":"pyload-ng (PyPI)","slug":"pyload-ng","vendor":{"name":"PyPI","slug":"pypi","url":"https://junglewise.ai/threats/vendors/pypi"},"aliases":[],"homepage":"https://pyload.net/","repo_url":"https://github.com/pyload/pyload","description":"A download manager written in Python that supports various file hosting sites.","url":"https://junglewise.ai/threats/technologies/pyload-ng"},"most_severe":[{"cve":"CVE-2024-22416","cvss":9.6,"epss":0.0095,"slug":"cve-2024-22416-pyload-pyload-ng-csrf-leading-to-admin-privilege-escalation","title":"pyLoad pyload-ng CSRF leading to admin privilege escalation","severity":"critical","exploited":false,"published_at":"2024-01-19T15:27:12+00:00","url":"https://junglewise.ai/threats/cve-2024-22416-pyload-pyload-ng-csrf-leading-to-admin-privilege-escalation"},{"cve":"CVE-2024-47821","cvss":9.1,"epss":0.0068,"slug":"cve-2024-47821-pyload-remote-code-execution-via-flashgot-api-and-scripts-folder","title":"pyLoad remote code execution via flashgot API and scripts folder manipulation","severity":"critical","exploited":false,"published_at":"2024-10-28T12:23:29+00:00","url":"https://junglewise.ai/threats/cve-2024-47821-pyload-remote-code-execution-via-flashgot-api-and-scripts-folder"},{"cve":"CVE-2026-35459","cvss":9.1,"epss":0.0038,"slug":"cve-2026-35459-pyload-ssrf-via-http-redirect-bypass-in-basedownloader","title":"pyLoad SSRF via HTTP redirect bypass in BaseDownloader","severity":"critical","exploited":false,"published_at":"2026-04-06T20:16:28.22+00:00","url":"https://junglewise.ai/threats/cve-2026-35459-pyload-ssrf-via-http-redirect-bypass-in-basedownloader"},{"cve":"CVE-2026-41133","cvss":8.8,"epss":0.0047,"slug":"cve-2026-41133-pyload-has-stale-session-privilege-after-role-permission-change","title":"pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)","severity":"high","exploited":false,"published_at":"2026-04-14T23:38:35+00:00","url":"https://junglewise.ai/threats/cve-2026-41133-pyload-has-stale-session-privilege-after-role-permission-change"},{"cve":"CVE-2026-45348","cvss":8.7,"epss":0.0035,"slug":"cve-2026-45348-pyload-stored-xss-in-downloads-view-via-packages-js-template","title":"pyLoad stored XSS in Downloads view via packages.js template","severity":"high","exploited":false,"published_at":"2026-05-28T18:16:35.437+00:00","url":"https://junglewise.ai/threats/cve-2026-45348-pyload-stored-xss-in-downloads-view-via-packages-js-template"},{"cve":"CVE-2026-42313","cvss":8.3,"epss":0.0039,"slug":"cve-2026-42313-pyload-incorrect-authorization-in-proxy-configuration-settings","title":"pyLoad incorrect authorization in proxy configuration settings","severity":"high","exploited":false,"published_at":"2026-05-11T18:16:34.98+00:00","url":"https://junglewise.ai/threats/cve-2026-42313-pyload-incorrect-authorization-in-proxy-configuration-settings"},{"cve":"CVE-2026-42315","cvss":8.1,"epss":0.005,"slug":"cve-2026-42315-pyload-path-traversal-in-set-package-data-api","title":"pyLoad path traversal in set_package_data API","severity":"high","exploited":false,"published_at":"2026-05-11T18:16:35.26+00:00","url":"https://junglewise.ai/threats/cve-2026-42315-pyload-path-traversal-in-set-package-data-api"},{"cve":"CVE-2025-61773","cvss":8.1,"epss":0.0042,"slug":"cve-2025-61773-pyload-cnl-and-captcha-handlers-allow-code-injection-via","title":"pyLoad CNL and captcha handlers allow Code Injection via unsanitized parameters","severity":"high","exploited":false,"published_at":"2025-10-09T15:19:48+00:00","url":"https://junglewise.ai/threats/cve-2025-61773-pyload-cnl-and-captcha-handlers-allow-code-injection-via"},{"cve":"CVE-2026-35187","cvss":7.7,"epss":0.0037,"slug":"cve-2026-35187-pyload-ssrf-and-local-file-disclosure-in-parse-urls-api","title":"pyLoad SSRF and local file disclosure in parse_urls API","severity":"high","exploited":false,"published_at":"2026-04-06T20:16:27.207+00:00","url":"https://junglewise.ai/threats/cve-2026-35187-pyload-ssrf-and-local-file-disclosure-in-parse-urls-api"},{"cve":"CVE-2025-7346","cvss":7.5,"epss":0.0032,"slug":"cve-2025-7346-pyload-authentication-bypass-via-host-header-spoofing-in-local","title":"pyLoad authentication bypass via Host header spoofing in local_check","severity":"high","exploited":false,"published_at":"2025-07-08T21:36:52+00:00","url":"https://junglewise.ai/threats/cve-2025-7346-pyload-authentication-bypass-via-host-header-spoofing-in-local"}],"generated_at":"2026-09-26T13:07:00.120236+00:00"}