# pyload-ng (PyPI) vulnerabilities

Source: https://junglewise.ai/threats/technologies/pyload-ng  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/technologies/pyload-ng.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 59 vulnerabilities in pyload-ng (PyPI): 0 in the last 7 days and 11 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-75597, was published on 9 October 2026. Nothing in the last four weeks, down from 11 vulnerabilities in the four before.

## Counts

- Last 7 days: 0
- Last 30 days: 0
- Last 90 days: 11
- All time: 59 (3 critical, 0 exploited in the wild)

## About pyload-ng (PyPI)

Python download manager application with support for multiple protocols and remote control interface.

## Latest pyload-ng (PyPI) vulnerabilities

- [CVE-2026-75597: pyLoad unauthenticated template access and information disclosure](https://junglewise.ai/threats/cve-2026-75597-pyload-unauthenticated-access-to-web-path-filename-bypasses) (medium, CVSS 5.3, published 9 Oct 2026)
- [CVE-2026-48484: pyLoad API denial of service in multipart file upload handling](https://junglewise.ai/threats/cve-2026-48484-pyload-lack-of-input-size-validation-leads-to-denial-of-service) (medium, CVSS 6.5, published 9 Oct 2026)
- [pyload-ng authentication bypass in getUserData/get_userdata](https://junglewise.ai/threats/pyload-ng-getuserdata-get-userdata-exposed-at-perms-any-allow-any-cd197c9d) (high, CVSS 8.1, published 9 Oct 2026)
- [pyLoad rate-limit bypass and audit-log spoofing via X-Forwarded-For header](https://junglewise.ai/threats/pyload-rate-limit-bypass-and-audit-log-spoofing-via-trusted-client-0df0fd12) (medium, published 9 Oct 2026)
- [pyLoad session invalidation bypass in privilege revocation and password change](https://junglewise.ai/threats/pyload-privilege-revocation-and-password-change-through-the-rest-api-do-8e7301ba) (high, CVSS 7.5, published 9 Oct 2026)
- [pyLoad API.set_user_permission session invalidation bypass](https://junglewise.ai/threats/pyload-api-set-user-permission-never-invalidates-the-target-s-session-9c452634) (high, CVSS 7.5, published 9 Oct 2026)
- [pyLoad WindowsPhoneNotify addon SSRF via unguarded http.client](https://junglewise.ai/threats/pyload-windowsphonenotify-addon-non-admin-settings-user-triggers-ssrf-4450ab47) (medium, CVSS 6.4, published 9 Oct 2026)
- [pyLoad tar extraction creates device nodes and FIFOs](https://junglewise.ai/threats/pyload-tar-extraction-creates-device-nodes-and-fifos-member-types-not-27832dfe) (high, published 9 Oct 2026)
- [pyLoad API key authentication bypass in cache validation](https://junglewise.ai/threats/pyload-has-an-authentication-bypass-in-api-key-validation-check-apikey-cccaaa7b) (high, CVSS 8.1, published 9 Oct 2026)
- [CVE-2026-48987: pyLoad uncontrolled memory growth in EventManager](https://junglewise.ai/threats/cve-2026-48987-pyload-uncontrolled-memory-growth-in-eventmanager) (medium, CVSS 6.5, published 15 Sep 2026)
- [CVE-2026-48737: pyLoad pyload-ng SSRF bypass via IPv6 transition wrappers](https://junglewise.ai/threats/cve-2026-48737-pyload-pyload-ng-ssrf-bypass-via-ipv6-transition-wrappers) (medium, CVSS 4.9, published 15 Sep 2026)
- [CVE-2026-35464: pyLoad: Unprotected storage_folder enables arbitrary file write to Flask session store and code execution (Incomplete fix…](https://junglewise.ai/threats/cve-2026-35464-pyload-unprotected-storage-folder-enables-arbitrary-file-write-to) (low, CVSS 3.1, published 13 Jul 2026)
- [CVE-2026-33509: pyLoad SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration](https://junglewise.ai/threats/cve-2026-33509-pyload-settings-permission-users-can-achieve-remote-code) (low, CVSS 3.1, published 13 Jul 2026)
- [CVE-2025-57751: PYSEC-2026-1815 - Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs](https://junglewise.ai/threats/cve-2025-57751-denial-of-service-attack-in-pyload-cnl-blueprint-using-dukpy) (medium, CVSS 4, published 7 Jul 2026)
- [CVE-2025-55156: PYSEC-2026-1821 - PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameter](https://junglewise.ai/threats/cve-2025-55156-pyload-vulnerable-to-sql-injection-via-api-json-add-package-in) (medium, CVSS 4, published 7 Jul 2026)
- [CVE-2025-54140: PYSEC-2026-1823 - `pyLoad` has Path Traversal Vulnerability in `json/upload` Endpoint that allows Arbitrary File Write](https://junglewise.ai/threats/cve-2025-54140-pyload-has-path-traversal-vulnerability-in-json-upload-endpoint) (low, CVSS 3.1, published 7 Jul 2026)
- [CVE-2024-24808: PYSEC-2026-1817 - pyLoad open redirect vulnerability due to improper validation of the is_safe_url function](https://junglewise.ai/threats/cve-2024-24808-pyload-open-redirect-vulnerability-due-to-improper-validation-of) (low, CVSS 3.1, published 7 Jul 2026)
- [CVE-2024-21644: PYSEC-2026-1820 - pyload Unauthenticated Flask Configuration Leakage vulnerability](https://junglewise.ai/threats/cve-2024-21644-pyload-unauthenticated-flask-configuration-leakage-vulnerability) (low, CVSS 3.1, published 7 Jul 2026)
- [CVE-2024-21645: PYSEC-2026-1818 - pyload Log Injection vulnerability](https://junglewise.ai/threats/cve-2024-21645-pyload-log-injection-vulnerability) (low, CVSS 3.1, published 7 Jul 2026)
- [CVE-2023-47890: PYSEC-2026-1819 - Download to arbitrary folder can lead to RCE](https://junglewise.ai/threats/cve-2023-47890-download-to-arbitrary-folder-can-lead-to-rce) (low, CVSS 3.1, published 7 Jul 2026)
- [CVE-2023-0488: PYSEC-2026-907 - Cross-site Scripting in pyload-ng](https://junglewise.ai/threats/cve-2023-0488-cross-site-scripting-in-pyload-ng) (low, CVSS 3.1, published 7 Jul 2026)
- [CVE-2023-0509: PYSEC-2026-903 - Improper Certificate Validation in pyload-ng](https://junglewise.ai/threats/cve-2023-0509-improper-certificate-validation-in-pyload-ng) (low, CVSS 3, published 7 Jul 2026)
- [CVE-2023-0434: PYSEC-2026-908 - Improper Input Validation in pyload-ng](https://junglewise.ai/threats/cve-2023-0434-improper-input-validation-in-pyload-ng) (low, CVSS 3, published 7 Jul 2026)
- [CVE-2023-0227: PYSEC-2026-906 - Pyload Insufficient Session Expiration vulnerability](https://junglewise.ai/threats/cve-2023-0227-pyload-insufficient-session-expiration-vulnerability) (low, CVSS 3.1, published 7 Jul 2026)
- [CVE-2023-0057: PYSEC-2026-904 - pyLoad vulnerable to Improper Restriction of Rendered UI Layers or Frames](https://junglewise.ai/threats/cve-2023-0057-pyload-vulnerable-to-improper-restriction-of-rendered-ui-layers-or) (low, CVSS 3.1, published 7 Jul 2026)

## Most severe pyload-ng (PyPI) vulnerabilities

- [CVE-2024-22416: pyLoad pyload-ng CSRF leading to admin privilege escalation](https://junglewise.ai/threats/cve-2024-22416-pyload-pyload-ng-csrf-leading-to-admin-privilege-escalation) (critical, CVSS 9.6, published 19 Jan 2024)
- [CVE-2024-47821: pyLoad remote code execution via flashgot API and scripts folder manipulation](https://junglewise.ai/threats/cve-2024-47821-pyload-remote-code-execution-via-flashgot-api-and-scripts-folder) (critical, CVSS 9.1, published 28 Oct 2024)
- [CVE-2026-35459: pyLoad SSRF via HTTP redirect bypass in BaseDownloader](https://junglewise.ai/threats/cve-2026-35459-pyload-ssrf-via-http-redirect-bypass-in-basedownloader) (critical, CVSS 9.1, published 6 Apr 2026)
- [CVE-2026-41133: pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)](https://junglewise.ai/threats/cve-2026-41133-pyload-has-stale-session-privilege-after-role-permission-change) (high, CVSS 8.8, published 22 Apr 2026)
- [CVE-2026-45348: pyLoad stored XSS in Downloads view via packages.js template](https://junglewise.ai/threats/cve-2026-45348-pyload-stored-xss-in-downloads-view-via-packages-js-template) (high, CVSS 8.7, published 28 May 2026)
- [CVE-2026-42313: pyLoad incorrect authorization in proxy configuration settings](https://junglewise.ai/threats/cve-2026-42313-pyload-incorrect-authorization-in-proxy-configuration-settings) (high, CVSS 8.3, published 11 May 2026)
- [CVE-2026-42315: pyLoad path traversal in set_package_data API](https://junglewise.ai/threats/cve-2026-42315-pyload-path-traversal-in-set-package-data-api) (high, CVSS 8.1, published 11 May 2026)
- [CVE-2025-61773: pyLoad CNL and captcha handlers allow Code Injection via unsanitized parameters](https://junglewise.ai/threats/cve-2025-61773-pyload-cnl-and-captcha-handlers-allow-code-injection-via) (high, CVSS 8.1, published 9 Oct 2025)
- [pyload-ng authentication bypass in getUserData/get_userdata](https://junglewise.ai/threats/pyload-ng-getuserdata-get-userdata-exposed-at-perms-any-allow-any-cd197c9d) (high, CVSS 8.1, published 9 Oct 2026)
- [pyLoad API key authentication bypass in cache validation](https://junglewise.ai/threats/pyload-has-an-authentication-bypass-in-api-key-validation-check-apikey-cccaaa7b) (high, CVSS 8.1, published 9 Oct 2026)

## Vulnerabilities per week

Nothing in the last four weeks, down from 11 vulnerabilities in the four before.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 0 | 0 | 0 |
| 31 Aug 2026 | 0 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 2 | 0 | 0 |
| 21 Sep 2026 | 0 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 9 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 0 | 0 | 0 |

## Other PyPI technologies

- [tensorflow (PyPI)](https://junglewise.ai/threats/technologies/pypi-tensorflow): 435 vulnerabilities
- [tensorflow-cpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-cpu): 430 vulnerabilities
- [tensorflow-gpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-gpu): 427 vulnerabilities
- [open-webui (PyPI)](https://junglewise.ai/threats/technologies/open-webui): 177 vulnerabilities
- [Django (PyPI)](https://junglewise.ai/threats/technologies/django): 173 vulnerabilities
- [apache-airflow (PyPI)](https://junglewise.ai/threats/technologies/apache-airflow): 159 vulnerabilities
- [pillow (PyPI)](https://junglewise.ai/threats/technologies/pillow): 125 vulnerabilities
- [praisonai (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonai): 120 vulnerabilities
- [vllm (PyPI)](https://junglewise.ai/threats/technologies/pypi-vllm): 117 vulnerabilities
- [plone (PyPI)](https://junglewise.ai/threats/technologies/pypi-plone): 101 vulnerabilities
- [mlflow (PyPI)](https://junglewise.ai/threats/technologies/mlflow): 88 vulnerabilities
- [picklescan (PyPI)](https://junglewise.ai/threats/technologies/picklescan): 86 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "pyload-ng (PyPI) vulnerabilities", https://junglewise.ai/threats/technologies/pyload-ng, 13 November 2026.