# pyLoad vulnerabilities Source: https://junglewise.ai/threats/technologies/pyload Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 00:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/pyload.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 13 vulnerabilities in pyLoad: 2 in the last 7 days and 9 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-123816, was published on 9 November 2026. Nothing in the last four weeks, down from 7 vulnerabilities in the four before. ## Counts - Last 7 days: 2 - Last 30 days: 2 - Last 90 days: 9 - All time: 13 (1 critical, 0 exploited in the wild) ## About pyLoad Python-based file download manager for retrieving content from the internet. ## Latest pyLoad vulnerabilities - [CVE-2026-123816: pyLoad API key validation cache authentication bypass](https://junglewise.ai/threats/cve-2026-123816-pyload-is-a-free-and-open-source-download-manager-written-in) (high, CVSS 8.1, published 9 Nov 2026) - [CVE-2026-123814: pyLoad WindowsPhoneNotify SSRF in notification addon](https://junglewise.ai/threats/cve-2026-123814-pyload-is-a-free-and-open-source-download-manager-written-in) (medium, CVSS 6.4, published 9 Nov 2026) - [CVE-2026-75597: pyLoad unauthenticated template access and information disclosure](https://junglewise.ai/threats/cve-2026-75597-pyload-unauthenticated-access-to-web-path-filename-bypasses) (medium, CVSS 5.3, published 9 Oct 2026) - [CVE-2026-48484: pyLoad API denial of service in multipart file upload handling](https://junglewise.ai/threats/cve-2026-48484-pyload-lack-of-input-size-validation-leads-to-denial-of-service) (medium, CVSS 6.5, published 9 Oct 2026) - [pyLoad rate-limit bypass and audit-log spoofing via X-Forwarded-For header](https://junglewise.ai/threats/pyload-rate-limit-bypass-and-audit-log-spoofing-via-trusted-client-0df0fd12) (medium, published 9 Oct 2026) - [pyLoad session invalidation bypass in privilege revocation and password change](https://junglewise.ai/threats/pyload-privilege-revocation-and-password-change-through-the-rest-api-do-8e7301ba) (high, CVSS 7.5, published 9 Oct 2026) - [pyLoad API.set_user_permission session invalidation bypass](https://junglewise.ai/threats/pyload-api-set-user-permission-never-invalidates-the-target-s-session-9c452634) (high, CVSS 7.5, published 9 Oct 2026) - [pyLoad WindowsPhoneNotify addon SSRF via unguarded http.client](https://junglewise.ai/threats/pyload-windowsphonenotify-addon-non-admin-settings-user-triggers-ssrf-4450ab47) (medium, CVSS 6.4, published 9 Oct 2026) - [pyLoad API key authentication bypass in cache validation](https://junglewise.ai/threats/pyload-has-an-authentication-bypass-in-api-key-validation-check-apikey-cccaaa7b) (high, CVSS 8.1, published 9 Oct 2026) - [CVE-2026-44226: pyLoad pyload-ng information disclosure in WebUI error handler](https://junglewise.ai/threats/cve-2026-44226-pyload-pyload-ng-information-disclosure-in-webui-error-handler) (medium, CVSS 5.3, published 11 May 2026) - [CVE-2026-42315: pyLoad path traversal in set_package_data API](https://junglewise.ai/threats/cve-2026-42315-pyload-path-traversal-in-set-package-data-api) (high, CVSS 8.1, published 11 May 2026) - [CVE-2026-41133: pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)](https://junglewise.ai/threats/cve-2026-41133-pyload-has-stale-session-privilege-after-role-permission-change) (high, CVSS 8.8, published 22 Apr 2026) - [CVE-2026-35459: pyLoad SSRF via HTTP redirect bypass in BaseDownloader](https://junglewise.ai/threats/cve-2026-35459-pyload-ssrf-via-http-redirect-bypass-in-basedownloader) (critical, CVSS 9.1, published 6 Apr 2026) ## Most severe pyLoad vulnerabilities - [CVE-2026-35459: pyLoad SSRF via HTTP redirect bypass in BaseDownloader](https://junglewise.ai/threats/cve-2026-35459-pyload-ssrf-via-http-redirect-bypass-in-basedownloader) (critical, CVSS 9.1, published 6 Apr 2026) - [CVE-2026-41133: pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)](https://junglewise.ai/threats/cve-2026-41133-pyload-has-stale-session-privilege-after-role-permission-change) (high, CVSS 8.8, published 22 Apr 2026) - [CVE-2026-42315: pyLoad path traversal in set_package_data API](https://junglewise.ai/threats/cve-2026-42315-pyload-path-traversal-in-set-package-data-api) (high, CVSS 8.1, published 11 May 2026) - [CVE-2026-123816: pyLoad API key validation cache authentication bypass](https://junglewise.ai/threats/cve-2026-123816-pyload-is-a-free-and-open-source-download-manager-written-in) (high, CVSS 8.1, published 9 Nov 2026) - [pyLoad API key authentication bypass in cache validation](https://junglewise.ai/threats/pyload-has-an-authentication-bypass-in-api-key-validation-check-apikey-cccaaa7b) (high, CVSS 8.1, published 9 Oct 2026) - [pyLoad session invalidation bypass in privilege revocation and password change](https://junglewise.ai/threats/pyload-privilege-revocation-and-password-change-through-the-rest-api-do-8e7301ba) (high, CVSS 7.5, published 9 Oct 2026) - [pyLoad API.set_user_permission session invalidation bypass](https://junglewise.ai/threats/pyload-api-set-user-permission-never-invalidates-the-target-s-session-9c452634) (high, CVSS 7.5, published 9 Oct 2026) - [CVE-2026-48484: pyLoad API denial of service in multipart file upload handling](https://junglewise.ai/threats/cve-2026-48484-pyload-lack-of-input-size-validation-leads-to-denial-of-service) (medium, CVSS 6.5, published 9 Oct 2026) - [CVE-2026-123814: pyLoad WindowsPhoneNotify SSRF in notification addon](https://junglewise.ai/threats/cve-2026-123814-pyload-is-a-free-and-open-source-download-manager-written-in) (medium, CVSS 6.4, published 9 Nov 2026) - [pyLoad WindowsPhoneNotify addon SSRF via unguarded http.client](https://junglewise.ai/threats/pyload-windowsphonenotify-addon-non-admin-settings-user-triggers-ssrf-4450ab47) (medium, CVSS 6.4, published 9 Oct 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 7 vulnerabilities in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 7 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 2 | 0 | 0 | ## Other pyLoad technologies - [pyLoad Next Generation](https://junglewise.ai/threats/technologies/pyload-next-generation): 22 vulnerabilities - [pyLoad Next Gen](https://junglewise.ai/threats/technologies/pyload-next-gen): 7 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "pyLoad vulnerabilities", https://junglewise.ai/threats/technologies/pyload, 12 November 2026.